Internet Explorer 11 is not supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Missouri Finds Data Flaw, Offers Credit Monitoring

The state will spend $800,000 to offer free credit monitoring to teachers whose Social Security numbers were left vulnerable from a flaw in the education department’s database that was found by the St. Louis Post-Dispatch.

(TNS) — Missouri Gov. Mike Parson's administration is spending $800,000 to offer credit monitoring to teachers whose Social Security numbers were left vulnerable on a state website, weeks after he referred a St. Louis Post-Dispatch reporter for criminal investigation for notifying the state of the flaw.

The service will be provided to 620,000 current and former teachers whose information was in the HTML source code of a database of teacher certification — more than six times the number the Post-Dispatch estimated last month when it found the Social Security numbers were publicly accessible to anyone with a web browser.

The reporter notified the Department of Elementary and Secondary Education (DESE) of the flaw and withheld publication of a story about it until the database was taken offline.

Nevertheless, days later Parson held a press conference accusing the reporter of "hacking" and referred the reporter and newspaper for a criminal investigation by the Missouri State Highway Patrol. The incident that drew widespread criticism from data security and technology experts.

That investigation is still ongoing, according to patrol Capt. John Hotz. Those interviewed so far have included Shaji Khan, a University of Missouri — St. Louis cybersecurity expert whom the Post-Dispatch consulted to verify the data flaw. Cole County Prosecutor Locke Thompson will ultimately make a decision on whether to bring charges.

The cost of the credit and identity theft monitoring services, which DESE officials said in a news release they were able to reduce by signing onto an existing contract, is far lower than the $50 million that Parson said last month the incident would cost Missouri taxpayers.

His administration has refused to substantiate that cost claim. But Democratic lawmakers on the House Budget Committee last month said through a legislative inquiry they found the money would be used for credit monitoring and a call center, not the criminal investigation.

The state a signed a contract with the monitoring company, IDX, last month. Services for the teachers will last one year, according to DESE.

The department has distanced itself from Parson's characterization of the incident as a "hacking."

"Educators have enough on their plates right now and I want to apologize to them for this incident and the additional inconvenience it may cause them," DESE commissioner Margie Vandeven said in a news release. "It is unacceptable. The security of the data we collect is of the utmost importance to our agency."

(c)2021 The Kansas City Star (Kansas City, Mo.) Distributed by Tribune Content Agency, LLC.

Special Projects