Graduation Alliance suffers potential cyber attack that could have compromised Tennessee students' information

• The potential cyber attack could have compromised information including students’ personal data such as names, dates of birth, gender, ethnicity, and ACT scores for a subset of students.
• However, no Social Security numbers or addresses were compromised.

Graduation Alliance suffered a potential data breach that could have compromised the personal information of thousands of public school students across Tennessee after an unauthorized third-party potentially gained access to its servers.

Graduation Alliance is a third-party vendor that hosts CollegeforTN.org, a college and career-planning website.

What happened?

Upon learning the incident, Graduation Alliance took down the compromised server and notified the Tennessee Higher Education Commission (THEC) and the Department of Education about the incident.

Upon receiving notice from the vendor, THEC notified the Tennessee Bureau of Investigation, the Office of the Comptroller, as well as all other state agency stakeholder.

What information was compromised?

• The potential cyber attack could have compromised information including students’ personal data such as names, dates of birth, gender, ethnicity, and ACT scores for a subset of students.
• However, no Social Security numbers or addresses were compromised.

What was the response?

• Graduation Alliance has hired independent forensic experts to conduct an extensive investigation to determine whether any student information was accessed.
• The Tennessee Higher Education Commission is also investigating the incident to determine the scope of the attack.

“We’ll be monitoring the investigation closely and will provide updates for students and their parents as information becomes available. We are working closely with law enforcement to ensure students’ privacy is protected.” Mike Krause, Executive Director at THEC said.

Update: Graduation Alliance has finished the investigation and found that no student data was accessed, stolen or viewed by any unauthorized persons. In its statement, the Graduation Alliance said that, “Graduation Alliance (GA), an accredited education services provider, successfully completed an investigation finding no evidence that any student data was accessed, stolen or viewed by any unauthorized persons during a recent attack on a testing environment for a college and career exploration and planning platform for two customers. GA was assisted in its investigation by an independent forensic firm. No public-facing websites or systems were affected in this incident."