Needham schools say system was breached

Student accused of hacking data

A junior at Needham High School posted students' schedules and identification numbers and teachers' classroom rosters on his Facebook account after hacking into an online student information system, school officials said yesterday.

In an e-mail sent yesterday morning to high school parents, principal Paul Richards and the district's superintendent, Dan Gutekanst, said the student admitted he had obtained and posted the information after learning part of a teacher's password, then developing a program to penetrate the system. The student posted the information as an Excel file that was e-mailed among other students.

"As you might imagine, this is a serious breach of our system and will require significant work to determine how to prevent this from happening again," stated the e-mail to parents.

Students who accessed the information notified school officials about the breach, and Richards talked to the alleged hacker. The student did not alter any information, Richards said. School officials did not release the boy's name.

A source familiar with the investigation said the 17-year-old student repeatedly tried to access the computer system. The student's hard drive was turned over to authorities, the source added.

Richards declined to comment on what action would be taken against the student but said police had been notified. The breach happened about two weeks ago.

"It's a serious matter, and we're treating it as such," Richards said. Police Chief Thomas J. Leary did not return a phone call seeking comment.

The student information system is called PowerSchool, a program the district implemented a year ago. It allows students in grades 6-12 to track attendance, schedules, and grades. Parents are given individual passwords to use the system.

Many area schools use the program to allow parents and students to follow their academic progress regularly. PowerSchool representatives could not be reached for comment.

The student could have accessed one teacher's grades, but did not do so, Richards said.

In the e-mail, school officials urged students to stop forwarding the file. Richards declined to comment on whether the information had been widely distributed.

"We ask you that you speak with your children and ask them not to pass along the file (which is still happening), but to instead delete the e-mail. If they have already downloaded the file, please ask them to delete it from the computer, for the information is stolen property," yesterday's e-mail said.