Through a multi-step process, an individual took the records of at least three educators, decoded the HTML source code, and viewed the SSN of those specific educators. We notified the Cole County prosecutor and the Highway Patrol’s Digital Forensic Unit will investigate.
Upon receiving this notice, DESE immediately contacted the Missouri Office of Administration ITSD, who programs and maintains the web application, to remove public access to the portal and update the code.
This matter is serious. The state is committing to bring to justice anyone who hacked our system and anyone who aided or encouraged them to do so — in accordance with what Missouri law allows AND requires.
A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert and decode the code.
Under Missouri law, a person commits the offense of tampering with computer data if he or she knowingly and without authorization accesses, takes, and examines personal information without permission. This data was not freely available and had to be converted and decoded.
The state does not take this matter lightly and we are working to strengthen our security to prevent this incident from happening again. The state is owning its part, and we are addressing areas in which we need to do better than we have done before.
We will not rest until we clearly understand the intentions of this individual and why they were targeting Missouri teachers.
@GovParsonMO Tell me you know nothing about HTML coding and cybersecurity without telling me you know nothing about HTML coding and cybersecurity. The fault here is NOT with the person who hit F12 on the keyboard and then noticed unmasked SSNs. It's with the genius who designed the site.
@twcarey @GovParsonMO Who wants to bet those SSNs are stored in plain text too.
@EricMaurer @GovParsonMO That's what the reporter found when he hit "view source code." So he told the school district, who fixed the website, prior to publishing the article. I think this reporter did everything absolutely right. Too bad the #GOQ governor of MO hasn't a clue about how anything works.