A community college system in Arizona is now under fire due to a data breach affecting 2.4 million people, according to a new lawsuit. Administrators from Maricopa County Community College District are accused of improperly handling a system hack dating back to January 2011, which lead to a bigger security breach in April 2013.
According to the suit, district officials didn’t notify those affected until November 2013 that their banking information, social security numbers and student academic information may have been exposed. The records involved stretch back 30 years and may include information from current students, former students, staff and vendors, according to local media. The lawsuit seeks $2,500 for each named plaintiff.
The news source also wrote that the district has authorized spending about $17 million to deal with the incident, which includes $10 million for credit monitoring and remediation and another $7 million to repair their network.
Interestingly enough, the news articles referenced for this blog post do not mention Family Educational Rights and Privacy Act (FERPA), although the district has a policy related to the federal regulation on its website. This data breach seems to be a clear violation of FERPA, which ties the protection of student data to Title IV funding.