A cyberattack that disrupted the Upper Perkiomen School District during the previous school year exposed the personal information of residents and students. Administrators, who referred to the incident six months ago as a network outage, confirmed the result in letters sent late last month to impacted parents, students, graduates, and others.

            Board President Melanie Cunningham said she was not sure what the total cost to the district would be. Reached Wednesday morning, Cunningham said the district acquired insurance to help cover some or all of the expenses. However, she could not provide the cost of the deductible.

            Alexis Jenofsky, the district's director of communications, was unable to provide any details related to the financial cost to the district or the number of people impacted. In an email message received Wednesday morning, Jenofsky wrote that the district is notifying students whose education file information may have been impacted in accordance with federal regulations.

            On Aug. 27, the district alerted parents of current students, past students and taxpayers that an investigation determined that an unauthorized individual encrypted portions of the district's network and copied certain files between March 1 and March 12. Working with a data privacy law firm, the district completed a review of the situation on Aug. 19 and worked as quickly as possible to deliver the details, according to a letter sent to a 2019 graduate of Upper Perkiomen.

            The letter, obtained by the Town and Country newspaper, states that the person's Social Security number and medical information were exposed. A similar letter to a 2004 graduate identifies the exposure of a Social Security number and health insurance information.

            Information mailed to a resident with a child in the district states the potential exposure of a Social Security number and health information. Two letters sent to taxpayers identified the exposure of Social Security numbers.

            Only individuals whose information was present in the reviewed files received notice, according to a message from Jenofsky.

            Working with its data privacy attorneys, Mullen Coughlin, LLC, the district undertook a comprehensive review of the involved files to determine what data was present and to whom the data relates in order to provide notification to individuals, according to the spokesperson.

            Jenofsky's email states that the detailed and time-intensive process involved working with eDiscovery specialists to carefully review a large volume of files and to identify potentially impacted individuals to provide legally required notifications as quickly as possible.

            The investigation determined that personal information was reviewed, according to the letter mailed to impacted residents. It states that while no evidence exists that any of the information has been used fraudulently, the district is offering access to single-bureau credit monitoring, credit report and credit score services for one year from My TrueIdentity.

            The district is covering the cost of the monitoring, according to Cunningham.

            Additionally, the district is providing complimentary proactive fraud insurance through Cyberscout, a TransUnion company that specializes in fraud assistance and remediation services. The letter – sent in care of Cyberscout, based in Dearborn, Mich. – encouraged those whose information was exposed to "remain vigilant against incidents of identity theft and fraud by reviewing your account statements and monitoring your fee credit reports for suspicious activity and to detect errors."

            In March, the school board identified the disruption as a network outage. Superintendent Allyn Roche announced during a March 14 meeting that an issue discovered two days earlier had disrupted its computer system. Roche described the technical difficulties as the "elephant in the room."

            The following week, two school board members and the superintendent declined to answer a series of questions regarding the nature of the incident, the possible exposure of any personal information, and the potential financial cost to the district.

            Roche did not respond to a text message sent on March 19.

            Cunningham and J. P. Prego, who chairs the district's facilities committee, were each sent the questions one day earlier. Prego wrote in a text message that he could not offer anything more on the situation beyond Roche's statement.

            Both school board members deferred all questions to spokesperson Jenofsky. On March 21, she sent a text message declining to address the issue.  "At this time, the district has no further comment," Jenofsky wrote in the message.

            On March 28, the board voted to ratify an engagement letter with a Chester County law firm related to the district's recent network outage. The members unanimously approved the agreement with Mullen Coughlin, LLC, of Devon.

            On April 1, the Town and Country newspaper filed a Right to Know request with the district seeking a copy of the letter, email and all other correspondence between school board members or the superintendent and representatives from Mullen Coughlin as well as any invoices from the firm to the school district and any payments made from the school district to the entity.

            In May, the district's Right to Know Officer delivered a 57-page document that included several heavily redacted email messages. An accompanying letter, received from Kristal Bitner, identified the justification for the redactions as the attorney-client privilege and the RTKL exemptions related to personal email addresses and cell phone numbers and information related to a noncriminal investigation.

            The response included copies of 26 email messages between administrators and firm employees between Thursday, March 28 and Monday, April 1. Words describing the subject of the firm's representation had been blacked out. Portions of the subject line and message text were redacted in nearly all the messages.

            A schedule page, identified as No. 7 of the engagement letter, explaining the firm's scope of work for the district is redacted, and the specific work to be performed was also blacked out.

            The letter's final page identified the hourly rates for legal personnel. Partners earned $385, while associates earned $325. Paralegals were paid $150.