{"id":10349,"date":"2024-04-08T14:46:52","date_gmt":"2024-04-08T14:46:52","guid":{"rendered":"https:\/\/gatlabs.com\/education\/?p=10349"},"modified":"2026-03-23T15:09:16","modified_gmt":"2026-03-23T15:09:16","slug":"school-data-breach-in-focus-how-to-protect-student-data-in-google-workspace","status":"publish","type":"post","link":"https:\/\/gatlabs.com\/education\/blog\/school-data-breach-in-focus-how-to-protect-student-data-in-google-workspace\/","title":{"rendered":"School Data Breach in Focus. How to Protect Student Data in Google Workspace"},"content":{"rendered":"

Student data is the most valuable resource stored in the school\u2019s domain. That\u2019s why a data breach at an educational institution hurts so much.<\/span><\/p>\n

Internet Safety Labs\u2019 research<\/span><\/a> shows alarming results. Student privacy in 78% of apps required or recommended for schools is \u201cvery high risk\u201d, and 79% of apps used in schools collect student location data.<\/strong><\/span><\/p>\n

In this post, we show three real-world examples that put student data at risk: from a massive breach of school data containing classified information to a hack of a student monitoring app. Later, we share tips on how to prevent data breaches in Google Workspace for Education.<\/span><\/p>\n

Cases of Data Breaches in Schools<\/h2>\n

The Leak of Emergency Procedures at US Schools<\/h3>\n

In <\/span>December 2023<\/span><\/a>, 800 GB of sensitive files from US schools were leaked, exposing institutions to potential security risks. Over 4 million records linked to an education software provider contained personal information about students, including health conditions, threats of self-harm, and examples of individual misbehaviour.\u00a0<\/span><\/p>\n

In addition, the disclosed files provided details of evacuation plans in case of various threats at the school, such as a shooter or a bomb attack. They included emergency assembly points, shelters for students, and floor plans. This data could be perfectly used by cybercriminals or local terrorists.\u00a0<\/span><\/p>\n

When contracting with a software company, make sure you can entrust it with the confidential information your school collects. Discovered US school files were uploaded to a third-party provider\u2019s system. Before submitting anything to an external cloud, consider double protection for data whose leaking could make your school\u2019s security system or individual students highly vulnerable.<\/span><\/p>\n

Privacy Breach After User Error in Canada<\/h3>\n

Saskatchewan, Canada, <\/span>February 2023<\/span><\/a>. An unauthorized user accidentally transfers school data from eight archived files to a third-party cloud service provider. As a result, the personal information of 20,000 former students and staff members of the 35-school division may have been stolen.<\/span><\/p>\n

The data affected by this security breach included<\/span> bank information, social insurance numbers, ages, gender, and student numbers of parents and students. Although there is no evidence that the data was copied from the provider\u2019s cloud storage, a security breach could still occur<\/span>\u00a0in the future. The l<\/span>eaked information could appear on the dark web and be used for opening a new bank account, applying for a mortgage, or ransom harassment.<\/span><\/p>\n

Even if a data breach has never directly affected your school, learn from the experiences of other institutions. Remember that <\/span>88% of data breaches are due to human error<\/span><\/a>. Regularly review and update user permissions in Google Workspace for Education to reduce the risk of accidental data leaks.<\/span><\/p>\n

Student Monitoring App Hacked at UK School<\/h3>\n

Many parents of students in Billingham were surprised when they began receiving multiple notifications on their student monitoring app in <\/span>January 2024<\/span><\/a>. Students were receiving virtual rewards from the teacher\u2019s account and explicit comments. As a result of the app hack, parents also gained access to children’s profiles<\/span> not connected to them.<\/span><\/p>\n

Given the language used in the comments, it\u2019s possible that students were responsible for hacking the school app. What is concerning is how easy it was to break the IT system. The company and schools immediately acted to avoid more damage after the alleged data breach.<\/span><\/p>\n

To prevent this, it is important to carefully verify and monitor any third-party apps installed on users’ Google Workspace accounts and the permissions these apps require. An effective school language policy and a content-monitoring tool will also help detect and prevent inappropriate language used by students in Google Classroom.<\/span><\/p>\n

How to Prevent Data Breaches at Your School<\/h2>\n

Effective data loss prevention not only safeguards student information from unauthorised parties and use but also saves school admins many working hours. Often, the price of a data breach is also the money spent to recover and reinforce the data storage, as well as the school\u2019s reputation and credibility, which cannot be so easily recovered.<\/span><\/p>\n

Look at the following tips to strengthen the protection of sensitive information in your school domain.<\/span><\/p>\n

1. Prevent School Data Breach<\/h3>\n

\u201cPrevention is better than cure, said Desiderius Erasmus in the 16th century. Five hundred years later, we stand by that statement as well when it comes to protecting s<\/span>tudent data in Google Workspace.<\/span><\/p>\n

Data breach prevention and response in schools starts with perfectly crafted <\/span>cybersecurity policies <\/b>for your e-learning environment. These policies should cover access control, data and password security, data retention, and classification policies, among other things.<\/span><\/p>\n

Create an<\/span> Incident Response Plan<\/b><\/a> for any kind of cybersecurity attack. Address prevalent online threats to act promptly and reduce incident costs. Consider common, real-life scenarios in schools, such as those mentioned in the first part of this article.<\/span><\/p>\n

\"\"<\/p>\n

2. Provide Secure Digital Infrastructure<\/h3>\n

Antivirus software<\/b> must be installed on every school device. Keep all browsers and systems properly configured and updated. All hardware and software used on devices must be documented and authorised. Ensure that only approved users can make changes to settings.<\/span><\/p>\n

Make sure that students and staff members can only log into their Google Classroom accounts on school devices through the <\/span>safe school network<\/b>. Students should only use a secure connection to access the e-learning platform when learning remotely.<\/span><\/p>\n

3. Apply Effective User Management<\/h3>\n

Installing third-party applications on your devices is like inviting guests into your house. You want to make sure they won\u2019t steal anything, right? Check carefully all apps you\u2019re giving access to school computers and what data they need permission to access. You can easily <\/span>audit all<\/span> third-party apps<\/b><\/a> installed in your school domain with GAT+<\/a><\/span>.\u00a0<\/span><\/p>\n

As the next step, <\/span>set up alerts<\/span><\/a> for new applications installed by users in your Google Workspace domain.<\/span><\/p>\n

Another essential aspect of safe data management is controlling<\/span> user access<\/b> to Drives and files in the school domain. Customise the level of permissions for each user\u2019s needs. <\/span>The Principle of Least Privilege<\/span><\/a> comes in handy to evaluate this element of domain security and <\/span>remove access <\/span><\/a>to files and folders shared with a user if needed.\u00a0<\/span><\/p>\n

Don\u2019t forget to audit <\/span>file shares<\/b> externally, especially if the user who did this is already suspended.<\/span><\/p>\n

The K-12 Admin’s Guide to Google Shared Drives Management<\/a><\/p><\/blockquote>\n