The service will be provided to 620,000 current and former teachers whose information was in the HTML source code of a database of teacher certification — more than six times the number the Post-Dispatch estimated last month when it found the Social Security numbers were publicly accessible to anyone with a web browser.
The reporter notified the Department of Elementary and Secondary Education (DESE) of the flaw and withheld publication of a story about it until the database was taken offline.
Nevertheless, days later Parson held a press conference accusing the reporter of "hacking" and referred the reporter and newspaper for a criminal investigation by the Missouri State Highway Patrol. The incident drew widespread criticism from data security and technology experts.
That investigation is still ongoing, according to patrol Capt. John Hotz. Those interviewed so far have included Shaji Khan, a University of Missouri-St. Louis cybersecurity expert whom the Post-Dispatch consulted to verify the data flaw. Cole County Prosecutor Locke Thompson will ultimately make a decision on whether to bring charges.
The cost of the credit and identity theft monitoring services, which DESE officials said in a news release they were able to reduce by signing onto an existing contract, is far lower than the $50 million that Parson said last month the incident would cost Missouri taxpayers.
His administration has refused to substantiate that cost claim. But Democratic lawmakers on the House Budget Committee last month said through a legislative inquiry they found the money would be used for credit monitoring and a call center, not the criminal investigation.
The state signed a contract with the monitoring company, IDX, last month. Services for the teachers will last one year, according to DESE.
The department has distanced itself from Parson's characterization of the incident as a "hacking."
"Educators have enough on their plates right now and I want to apologize to them for this incident and the additional inconvenience it may cause them," DESE commissioner Margie Vandeven said in a news release. "It is unacceptable. The security of the data we collect is of the utmost importance to our agency."
©2021 The Kansas City Star, Distributed by Tribune Content Agency, LLC.
