GUILFORD COUNTY, N.C. — It's time for parents to start receiving a report card for their students.
Monday evening, the parents at Mendenhall Middle School in Greensboro got an email with a link attached that stated:
"Your child’s report card is now available for viewing and downloading. Please use the Document Delivery link below to access your child’s report card. This document is password-protected; the password is the last four digits of your child’s student ID number. If you have more than one child attending the same school, please try all passwords to access the document. Please note that the link will remain active for seven days. You may use the Download link to download and save the report card for future reference. Thank you for supporting your child’s learning."
When parents clicked the link, filled out the information to get access to the document, they got more than they asked for.
Parents had access to all of the students report cards at Mendenhall Middle School. Not only that, but also got access to each students address, student ID, classes and grades.
Here's what a parent from Mendenhall Middle School sent WMFY and how that parent had access to different students report cards. The address, student ID's, and names are blacked out for the privacy of the students.
Off to the left, that's where parents can find a students name and click on it to review the report card.
The link remained open for five hours before the school broke the link. For parents who didn't see it, the report cards are now no longer accessible.
For the parents who did see it, they had to download it and now they can keep the information on their computers.
Ellen Gilbert is a parent at Mendenhall Middle School. She said she didn't believe it was real.
"It was disbelief at first I was like, there's no way, there's got to be some kind of hoax, I just couldn't believe it," said Gilbert. "When I had a break, I downloaded the email that requested four digit secure password for my son to access his report card and noticed it was taking a while to download and sure enough, within a couple of minutes that I had to exactly 627 report cards from every student at the school."
She said she had access to their grades, their addresses, and student ID numbers.
She said she worries about the student ID numbers because it accesses a lot of things and stays with the students throughout high school as long as they stay in the county. She said it access lunches, school assignments, grades and more.
"It's a huge security breach," Gilbert said.
Gilbert is also concerned about potential bulling that will come with the release of all the students grades.
"I'm not disappointed in my son's grades, but that's probably not the case for everyone," she said. "Cyber bullying is huge in today's time with social media, it really worries me to imagine, now that they have this information, what could be done, the possible fallout is, you know, I'm sure there's things I hadn't thought of that can happen."
She said GCS needs to step up and take action for this mistake.
"I know mistakes happen, but these people are in charge with protecting your children and a huge mistake was made with lots of possible fallout and so instead of the response that I kept getting 'working on it', I would like some reassurance that it's not going to happen again, and why did it happen? I don't know if that's been figured out or not, but what is going to be done moving forward for the possible repercussions of all this fallout," she said. "I would like to see them take some accountability for what happened and to reassure these parents because they failed, they have exploited these kids and not only do we deserve an apology but we deserve an explanation."
We reached out to Guilford County Schools and in a statement the distrtict said:
On Monday, November 7, due to an inadvertent error, families of students at Mendenhall Middle School received a schoolwide attachment instead of their individual student’s report card. The attachment has been disabled, and the program is back online. GCS is exploring additional safeguards with our vendor to prevent this from happening in the future.
As of 12:36, parents from other Guilford County Schools said the issue was resolved when receiving their students' report card. The parents from the other schools said they did not have access to all students' information.
Update on November 14:
GCS said in part in a release, "We have no reason to believe that anyone misused the data contained in the erroneous attachment, but we have been working with the North Carolina Department of Public Instruction and Powerschool to take every step to assure your students’ information remains private.
Per the recommendation of the NCDPI security team, all student passwords have been reset to a unique password and students will be asked to change their password to a new unique password private to them on Monday, November 14, 2022. If homework assignments were given that require students to access Canvas or other tools using their NCEdCloud passwords, they will not be able to access these programs over the weekend but will not be penalized."