BEAVERTON, Ore. — The Beaverton School District was hit by a cybersecurity incident that may have compromised student passwords, the district announced in a message posted to its website and sent to parents Tuesday night. Student passwords to email accounts, Google documents, Canvas and other platforms all may have been compromised.
The district said it discovered the security incident earlier in the evening and planned to reset the system at 8:30 p.m. Tuesday. Parents and students were warned to download any needed Google documents before 8 p.m. because the system reset would make accounts unavailable after that. The district said Tuesday night that students would be able to reset their passwords and get back into their accounts at school on Wednesday.
In a letter to families and staff Wednesday, the district said that it believes it knows "the origin and nature of the incident," but Beaverton police has asked them not to report the details because it's an active investigation. The letter also said that the district's IT teams are working on reinstating student accounts and devices but didn't give a time frame for when that would happen.
"This will take time," the district said. "Once a full-vetted plan is ready, we'll share it with you."
The district urged parents to check if their students have used their school passwords on any other platforms such as social media accounts. If so, then those accounts should also be assumed to be compromised, and students should change their passwords as soon as possible.
Kerry Tomlinson, a cyber news reporter with Ampere News, also urges students to change their passwords to their personal accounts — here's why.
"Cyber attackers steal databases full of people's passwords and names. And then they use automation to try that on a bunch of other accounts and platforms," said Tomlinson. "And a lot of the time they can get into other stuff if you're using that same password. They don't sit there and type it in one by one — they use automation. They can do tens of thousands of passwords at once."
And while Tomlinson says these cyber attacks can happen for a variety of reasons she shares a few password tips for everyone to keep in mind. Things like using a minimum of 12 characters or a unique sentence that doesn’t include former passwords.
She says you could also use a software program like a password manager to easily store and connect to your phone and laptop.
Anyone who believes their data or their student's data may have been compromised can also contact the Beaverton Police Department's non-emergency dispatch number at 503-629-0111 and reference case number 233181089.
The district did not release any further details, including how it was discovered or how long it may have been since the passwords became compromised.
See the full text of Wednesday's letter below:
Dear BSD Families and Staff,
Last night, we informed you that BSD had suffered a cybersecurity incident in which we believe that some student passwords used for email, Google, Canvas and other learning platforms may have been compromised. The incident forced us to take immediate action and temporarily disable student access to their accounts and to their district-issued Chromebooks.
While we believe that we know the origin and nature of the incident, we’ve been asked by the Beaverton Police Department not to disclose the details. This is an active investigation, and we don’t want to do anything to jeopardize the integrity of that investigation. We would caution the use of the word “hack” or “breach” until the full details are revealed.
Right now, our IT teams are working around the clock to preserve evidence for law enforcement. They’re also working on a process for reinstating student accounts and devices. This will take time. Once a full-vetted plan is ready, we’ll share it with you.
In the meantime, learning continues in our school buildings. Teachers, who still have access to their accounts and devices, are pivoting. They’ll communicate any information about assignments and due dates with students.
We appreciate your continued support and understanding.
___
Correction: A previous version of this article used the wrong name for Canvas.