US School Shooter Emergency Plans Exposed in a Highly Sensitive Database Leak WIRED

pTo revist this article visit My Profile then View saved storiesppTo revist this article visit My Profile then View saved storiesppMatt BurgessppEvery year hundreds of millions of files personal records and documents are accidentally exposed online Owners of dating apps colossal marketing databases and even a spy agency have published information to the web by leaving it in unsecured databases But the regularity with which these leaks happen doesnt make them any less alarmingespecially when the data is from thousands of schoolsppThousands of emergency planning documents from US schoolsincluding their safety procedures for active shooter emergencieswere leaked in a trove of more than 4 million records that were inadvertently made public Last month security researcher Jeremiah Fowler discovered 800 gigabytes of files and logs linked to school software provider Raptor Technologies The firm provides software that allows schools to track student attendance monitor visitors and manage emergency situations Raptor says its software is used by more than 5300 US school districts and 60000 schools around the worldppThe highly sensitive cache of documents included evacuation plans with maps showing the routes students should take and where they should gather during emergencies details of students who pose a threat on campus medical records court documents relating to restraining orders and family abuse and the names and ID numbers of staff students and their parents or guardians This is the most diverse group of documents Ive found says Fowler who detailed the findings for security firm vpnMentorppThe exposed records appeared in three unsecured web bucketsthe incident wasnt a hackand are dated from 2022 and 2023 Fowler says Most of the records appeared to be from schools based in the US The security researcher reported the leaked files to Raptor Technologies in December and the firm quickly made them inaccessibleppAround 75 percent of the exposed documents appeared to be threat reports details of safety drills or related to emergency procedures Fowler says These files document how individual schools would respond in specific emergencies and the results of their test events There is no evidence to show the files were accessed by a malicious person however the details they include could potentially be exploited by someone planning to attack a schoolppOne 25pluspage emergency response plan lists everything from fire drill evacuation and severe storm plans to lockdown and shelter in place procedures Among more than 20 scenarios it includes sections on bomb threats hostage situations gunshots at or near the school if a student has weapons and abductions Floor plans for some schools in the files include arrows from each classroom showing evacuation routes that students and staff should take One map of a school shows where elementary and secondary pupils should gather outside the school as well as a reunification area for families Another shows the location of a command center Another document says its confidentiality level designates it only for the use of school staff and public authoritiesppAndy GreenbergppScott GilbertsonppLauren GoodeppSteven LevyppOne school document titled active shooter lockdown drill provides a checklist of 11 questions that staff members need to fill in to analyze the schools performance in a drill This includes whether they heard a Code Red Drill being announced and whether windows and doors were locked when they checked Questions on the drill document also include whether noise or talking could be heard from nearby rooms and whether anyone answered the door when it was lockedppFowler says all the exposed documents appear to have been uploaded by schools to Raptor Technologies systems some at a regularly monthly cadence Within some school reports Fowler says he saw specific details such as officials noting doors that dont lock or that a security camera has not been working for months If a domestic terrorist had basically a working map of all the vulnerabilities of a government building or a school or anything that presents a huge hypothetical risk Fowler says Some of the maps even have arrows of which way the kids are going to run if theres an active shooter where theyre going to hide Ive never seen anything like thatppThe security researcher viewed a sample of the accessible documents to determine their authenticity and who they belonged toallowing the leak to be reported to Raptor Technologies WIRED is not naming any schools for safety reasonsppDavid Rogers chief marketing officer at Raptor Technologies tells WIRED the company immediately implemented remediation protocols to secure the exposed data once it was contacted and started an investigation into the issue We have communicated with all Raptor customers Rogers says There is no indication at this time that any such data was accessed by third parties beyond the cybersecurity researcher and Raptor Technologies personnel he says adding there is no reason to believe there has been any misuse of the informationppWe sincerely regret this issue and any concern or inconvenience it may have caused Rogers says The companys investigation into the incident is ongoing Rogers says adding that the safety and wellbeing of children staff and the community members of our customers is the top priority of Raptor TechnologiesppMultiple school districts contacted by WIRED about the breach did not respond to requests for comment or declined to commentppBeyond the safety reports included in the exposed files were documents and logs that detail personal information about students Some documents detail risks that individual students could pose their recent behavior and if it has been improving One document details threats or concerns about individual students It names a student who has been fighting and bullying other students almost daily for past two weeksppAnother a meeting agenda discussing students lists physical attacks made by students an individuals threats of selfharm and incidents of theft Student name is aggressive kicking scratching and fights while transitioning from the bus each morning one file says of a student It adds that the student locked himself in principals office and grabbed a pair of scissorsppAndy GreenbergppScott GilbertsonppLauren GoodeppSteven LevyppAlso in the exposed files were health forms listing students names their parents names and phone numbers their dentists and health conditions One file detailed a students type 1 diabetes whether they have glasses their last tetanus shot and more Other files included court orders detailing a person charged with Criminal Sexual Conduct With a Minor while yet another is a protective order for family abuse that names children and the person accused Fowler also saw temporary restraining orders and trespass notices that exclude people from visting the schoolsppBeyond posing potential physical security risks the exposure of the files could also have been a target for cybercriminals such as ransomware gangs Fowler says You have kids who have sensitive school records you have so many different implications here he says Schools colleges and education establishments have been hit by ransomware groups in recent years with some of the criminal gangs also turning to extortion of people using data they have stolenppAccording to security firm Emsisofts review of ransomware in the US at least 108 K12 districts and at least 72 postsecondary schools were impacted by ransomware in 2023 In some of these incidents sensitive files about students have been stolen and dumped online directly from schools without peoples knowledge Weve all done stupid stuff when we were kids and then we grew up and grew out of that Fowler says The real privacy issue is something you did as a kid could haunt you forever based on a data breachppUpdated at 1 pm ET January 11 2024 A graphic meant for an unrelated article was inadvertently included in an earlier version of this story We regret the errorpp Make the most of chatbots with our AI Unlocked newsletterppHow not to be stupid about AI with Yann LeCunppBlood guns and broken scooters The chaotic rise and fall of BirdppThe year the millennial internet diedppWomen in the US are stockpiling abortion pillsppWhat its like to use Apples Lockdown Modepp Charge right into travel season with the best travel adapters power banks and USB hubsppLily Hay NewmanppJoel KhalilippLily Hay NewmanppKate OFlahertyppMatt BurgessppAndy GreenbergppAndy GreenbergppLily Hay NewmanppMore From WIREDppReviews and Guidespp 2024 Condé Nast All rights reserved Use of this site constitutes acceptance of our User Agreement and Privacy Policy and Cookie Statement and Your California Privacy Rights WIRED may earn a portion of sales from products that are purchased through our site as part of our Affiliate Partnerships with retailers The material on this site may not be reproduced distributed transmitted cached or otherwise used except with the prior written permission of Condé Nast Ad Choicesp