"We investigated and notified any individuals that we needed to," Superintendent Travis Fleshner said in response to questions from The Courier. While the school district has already "worked through" issues related to the data breach, he noted in a written statement that some documents are still being reviewed to determine if they were accessed.
"In early April, the Union Community School District became aware of a cybersecurity incident that temporarily disrupted our computer systems and servers," Fleshner said in the statement.
"After discovering the incident, we quickly took steps to secure our systems and restore operations. We immediately initiated an investigation to determine the potential scope of the incident, and third-party forensics experts were engaged to assist in our investigation and remediation efforts. We also notified federal law enforcement."
It was determined "that the unauthorized individual acquired certain information from our systems," he said. As a result, the district began notifying affected people "out of an abundance of caution ... to provide additional guidance on how they can help to protect their information."
But as the ongoing investigation continued, officials "became aware of additional documents that may have been accessed by an unauthorized individual. Those documents are currently under review, and the District is committed to providing additional information to the community as quickly as possible," said Fleshner.
"We regret any concern this incident may cause our community, and we are continuing to enhance our cybersecurity policies, procedures and protocols to attempt to minimize the likelihood of this occurring again," he added.
Union Schools' policy on care, maintenance and disposal of records states that personal information of students or employees maintained electronically includes a secure backup file. Students' permanent records are preserved indefinitely while employment applications are kept for two years and payroll records for three. Non-payroll personnel records are maintained for 10 years after an employee leaves the district.
©2021 Waterloo-Cedar Falls Courier (Waterloo, Iowa). Distributed by Tribune Content Agency, LLC.
