Sachem Central School District is informing thousands of students and parents that some of their data were posted online in a security breach that is being investigated by authorities, the superintendent said.
The latest data leak at one of Long Island's largest districts included a list of 15,000 names of students -- apparently from the early 2000s -- with school ID numbers and lunch designations.
Also posted was a second list of 12,000 names and school ID numbers, but only about 900 names were not repeats, Superintendent James Nolan said.
And student records for about 360 Sachem High School East graduates from the 2008 year were listed. So was a report on about 130 Sachem High School North students in the 2010 to 2011 year who received "instructional services in an alternative setting," Nolan said in a statement on the Sachem website.
The host sites worked to scrub all "improper posts" after Sachem contacted them, he said.
Nolan, citing criminal probes announced earlier this month, declined to comment further.
"We have had extensive contact with both the Suffolk County Police Department and district attorney's office, as well as with the Federal Bureau of Investigation," his statement said.
Sachem's repeated computer audits have not uncovered hacking, Nolan said. The district needs student records for its daily operations, but this "can unfortunately render our data vulnerable to a determined criminal actor," he said.
The superintendent said he first learned of the latest leak Nov. 8. "The district has sent notices to the last known addresses of all of these individuals, and to an additional group of approximately 360 individuals whose records were stored in the same folder," he said.
Sachem "at this time" need not offer credit or identity protection to leak victims, he said.
Anyone who downloads data that is not about themselves or their child could get in trouble, he said. This is the third data breach in recent months for Sachem, which has 15,000 students and about 2,000 employees. It first learned "a small number of documents" about certain students were posted on an Internet forum in late July. Sachem immediately began a probe that included checking its computers.
After learning of claims that more student data were published in August, Sachem filed a criminal complaint with the Suffolk police.
However, the only leaked data that were uncovered at that time were "certain staff names, email addresses and other addresses, none of which contained Social Security numbers, credit card or driver's license information that would trigger additional reporting requirements," Nolan said.