Data Breach Union County FL
| Tracking # |
20240126 Complete 20231027 20230822 20230822 20230811 20230731 20230718 |
| Submitted | July 17, 2023 |
MuckRock users can file, duplicate, track, and share public records requests like this one. Learn more.
Communications
From: FOIA Disclosure Group
To Whom It May Concern:
Pursuant to the Florida Sunshine Law, we hereby request the following information:
Your agency name
Your agency state
Your agency type Business, Education K12, Education Higher
Your agency CEO
Breach is defined for this request as
A: An external actor that forcibly entered the system and accessed information
B: An internal actor that released or shared information that was not appropriate to share or shared intentionally without regard for entity protocol.
Please list any breach that was reported using the following format for the time period July 1, 2021 until July 1, 2023. Label each breach logically as Breach 1 or Breach 2, etc.*List each breach categorized as a document or an email as a separate breach.
For each breach provide the following information
1. Was this event for documents or email?
2. Date breach was reported
3. The position of the person reporting the breach
4. Highest position of administration the breach was reported to for the agency
5. Was the process or procedure for evaluating and notifying those impacted followed?
6. Were stakeholders with breached data notified? If so, what timeline after the breach was reported (weeks, days, hours) to the CEO listed above was the notification sent to those impacted?
7. What method(s) was used to notify stakeholders of the breach? Example, newspaper, social media, email, phone, mail, etc.
8. Was any protection such as credit monitoring or other protective opportunities provided to stakeholders affected?
9. Was the breached information considered protected under HIPAA or FERPA?
10. Count of records breached for category 1 above. (Emails and documents should NOT be included in the same count but reported as separate events even if the same date)
11. If the agency's process or procedure for evaluating and notification were not followed, what was the reasoning and by whom was the decision made to not follow the process or procedure?
Thank you in advance for your anticipated cooperation in this matter. We look forward to receiving your response to this request within 10 business days.
Sincerely,
FOIA Disclosure Group
From: Union County School District
Your request is being forwarded to our Custodian of Records, Cailyn
Stalnaker, for review and processing.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Union County School District
Your agency name - Union County School District
Your agency state-Florida
Your agency type Business, Education K12, Education Higher-Education K-12
Your agency CEO - Mike Ripplinger, Superintendent
Our District has not experienced a data breach for the time period requested.
From: Union County School District
I responded to hastily to this request. My Superintendent made me aware of a situation that will require further research on my part. I will respond once I have had adequate time to invest in this matter. Thank you for your understanding
From: Muckrock Staff
To Whom It May Concern:
I'm following up on the following Florida Sunshine Law request, copied below, and originally submitted on July 18, 2023. You had previously indicated that it would be completed on Aug. 4, 2023. I wanted to check on the status of my request, and to see if there was a new estimated completion date. You had assigned it reference number #20230731.
Thanks for your help, and let me know if further clarification is needed.
From: Union County School District
Good afternoon,
We are still researching this matter and will need more time to review the information to be able to provide an accurate response. Thank you for your patience.
From: Union County School District
To Whom It May Concern:
Pursuant to the Florida Sunshine Law, we hereby request the following information:
Your agency name Union County School District
Your agency state Florida
Your agency type Business, Education K12, Education Higher Education K-12
Your agency CEO Mike Ripplinger
Breach is defined for this request as
A: An external actor that forcibly entered the system and accessed information
B: An internal actor that released or shared information that was not appropriate to share or shared intentionally without regard for entity protocol.
Please list any breach that was reported using the following format for the time period July 1, 2021 until July 1, 2023. Label each breach logically as Breach 1 or Breach 2, etc.*List each breach categorized as a document or an email as a separate breach.
For each breach provide the following information
1. Was this event for documents or email?
Breach 1 - Documents - Upon review of the documents reported to some members of the Critical Incident Response Team (CIRT) as a breach, the documents in question were not found to meet the District Incident Response Plan definition of a breach.
Breach 2 - Emails - Upon review of the emails reported to some members of the Critical Incident Response Team (CIRT) as a breach, these emails in question were not found to meet the District Incident Response Plan definition of a breach.
2. Date breach was reported
Breach 1 - 5/19/2022
Breach 2 - 10/31/2022
3. The position of the person reporting the breach
Breach 1 - MIS Director
Breach 2 - MIS Director
4. Highest position of administration the breach was reported to for the agency
Breach 1 - Superintendent
Breach 2 - Superintendent
5. Was the process or procedure for evaluating and notifying those impacted followed?
Breach 1 - MIS Director notified two of the Critical Incident Response team members, however the complete team was not convened because the nature of the documents were not deemed a breach as defined by the District’s IRP.
Breach 2 - MIS Director notified two of the Critical Incident Response team members, however the complete team was not convened because the nature of the emails were not deemed a breach as defined by the District’s IRP.
6. Were stakeholders with breached data notified? If so, what timeline after the breach was reported (weeks, days, hours) to the CEO listed above was the notification sent to those impacted?
Breach 1 - No, upon review of the documents and the District’s Incident Response Plan (IRP), these documents were not deemed “critical” by the Superintendent.
Breach 2 - No, upon review of the documents and the District’s Incident Response Plan (IRP), these documents were not deemed “critical” by the Superintendent.
7. What method(s) was used to notify stakeholders of the breach? Example, newspaper, social media, email, phone, mail, etc.
Breach 1 - None, due to the understanding of the requirements listed in the Incident Response Plan
Breach 2 - None, due to the understanding of the requirements listed in the Incident Response Plan
8. Was any protection such as credit monitoring or other protective opportunities provided to stakeholders affected?
Breach 1 - The incident did not result in the release of personal information as defined in the District’s IRP
Breach 2 - The incident did not result in the release of personal information as defined in the District’s IRP
9. Was the breached information considered protected under HIPAA or FERPA?
Breach 1 - FERPA
Breach 2 - FERPA
10. Count of records breached for category 1 above. (Emails and documents should NOT be included in the same count but reported as separate events even if the same date)
Breach 1 - 1246
Breach 2 - 1067 - This total indicates the number of times the email in question had any type of activity, not necessarily resulting in any type of breach.
11. If the agency's process or procedure for evaluating and notification were not followed, what was the reasoning and by whom was the decision made to not follow the process or procedure?
Breach 1 - Upon review of the documents and the District’s Incident Response Plan (IRP), these documents were not deemed “critical” by the Superintendent.
Breach 2 - Upon review of the documents and the District’s Incident Response Plan (IRP), these documents were not deemed “critical” by the Superintendent.
Thank you in advance for your anticipated cooperation in this matter. We look forward to receiving your response to this request within 10 business days.
Sincerely,
FOIA Disclosure Group
From: FOIA Disclosure Group
Thanks for the report.
In you CRT (Term from your document), the superintendent is not a member of the team with the exception of when the HR director can not attend and therefore has no authority to make decisions on individual basis.
It appears the Superintendent violated the process designed to protect the system to legally reporting to stake holders what is required by law on matters that are protected under FERPA.
Amended request
Are the individuals identified in these items listed above still communicating on similar correspondence and how many (email and documents separately) have occurred since the 10/31/2022 date until present date?
Has the CRT been advised of these items?
From: Union County School District
Your amended request is being forwarded to Mrs. Cailyn Stalnaker, Custodian
of Records, for review and processing.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Union County School District
Our Technology department reviewed the accounts in question and no correspondence with the parties in question have occurred from the reporting date to the present date.
From: Union County School District
Our Technology department reviewed the accounts in question and no correspondence with the parties in question have occurred from the reporting date to the present date.
From: FOIA Disclosure Group
After multiple reviews some information in your latest response created confusion and further need for clarification. The group wishes to make sure it understands the entity's working document regarding a data breach as it relates to the steps the entity took to resolve the issue.
Initially your response was the CEO unilaterally determined (outside the scope of the entity's process) the events were not critical and the sharing and viewing of protected information was not a breach (Hillsborough Schools just reported an event as a breach where only 250 records were improperly viewed, far less than your entity).
In a recent followup dated August 11, 2023, it was stated the MIS Director at the time, followed up with two members of the critical response team on each event.
1. Please give the name, title and email address of these members that were contacted from the team, the MIS Director's name and email address when the breach occurred , the date they were contacted by the MIS Director and the content of the meeting regarding EACH event. A statement will be requested from these individuals.
2. Please send the names and email addresses of those reported as creating the breach.
3. Also, this is by no means saying the information is not correct but just wanted to confirm for the official record responded to on August 22, 2023. As of the date of the second breach reporting, October 31, 2022, the official statement is no other emails or document sharing occurred between the individuals that created the breach after this reporting date. This is not saying the information is not correct but it seems rare that the email and communications between the individuals involved in the breach ceased on the same day the breach was reported. Is that still the official statement?
From: Union County School District
Your request is being forwarded to our Custodian of Records, Mrs. Cailyn
Stalnaker, for review and processing. Please contact Mrs. Stalnaker if you
have any further questions or requests. I have included her in this
response so that you have her direct email address.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Muckrock Staff
To Whom It May Concern:
I'm following up on the following Florida Sunshine Law request, copied below, and originally submitted on July 18, 2023. You had previously indicated that it would be completed on Aug. 22, 2023. I wanted to check on the status of my request, and to see if there was a new estimated completion date. You had assigned it reference number #20230822.
Thanks for your help, and let me know if further clarification is needed.
From: FOIA Disclosure Group
Just following up again on request dated 10.12.2023
Thank you.
From: Union County School District
Good afternoon,
You have reached the email address for Public Records Requests for Union
County District Schools.
We thank you for your questions, however, if the answers are not found
within a record, we won't be able to help you. Your question is better
phrased in the form of a request for a record. Also, if a record doesn't
exist we cannot create a record to satisfy your request.
We await your response for your request for records. Once we receive your
response, we will begin the discovery process and will contact you upon
completion with an estimate of cost for such records should they exist.
Please feel free to contact us at this email address should you have any
questions concerning this matter.
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Union County School District
Good afternoon,
You have reached the email address for Public Records Requests for Union County District Schools.
We thank you for your questions, however, if the answers are not found within a record, we won't be able to help you. Your question is better phrased in the form of a request for a record. Also, if a record doesn't exist we cannot create a record to satisfy your request.
We await your response for your request for records. Once we receive your response, we will begin the discovery process and will contact you upon completion with an estimate of cost for such records should they exist.
Please feel free to contact us at this email address should you have any questions concerning this matter.
From: FOIA Disclosure Group
These are the questions needing a response. These are statements made in your previous replies that need a response.
In a recent followup dated August 11, 2023, it was stated the MIS Director at the time, followed up with two members of the critical response team on each event.
1. Please give the name, title and email address of these members that were contacted from the team, the MIS Director's name and email address when the breach occurred , the date they were contacted by the MIS Director and the content of the meeting regarding EACH event. A statement will be requested from these individuals.
2. Please send the names and email addresses of those reported as creating the breach.
3. Also, this is by no means saying the information is not correct but just wanted to confirm for the official record responded to on August 22, 2023. As of the date of the second breach reporting, October 31, 2022, the official statement is no other emails or document sharing occurred between the individuals that created the breach after this reporting date. This is not saying the information is not correct but it seems rare that the email and communications between the individuals involved in the breach ceased on the same day the breach was reported. Is that still the official statement?
From: Union County School District
Your request is being forwarded to our Custodian of Records, Mrs. Cailyn
Stalnaker for review. If you have any further questions please contact her
directly at mis@union.k12.fl.us for assistance.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Muckrock Staff
To Whom It May Concern:
I'm following up on the following Florida Sunshine Law request, copied below, and originally submitted on July 18, 2023. You had previously indicated that it would be completed on Oct. 27, 2023. I wanted to check on the status of my request, and to see if there was a new estimated completion date. You had assigned it reference number #20231027.
Thanks for your help, and let me know if further clarification is needed.
From: Union County School District
Your follow-up request is being forwarded to Mrs. Cailyn Stalnaker, our
Custodian of Records, for review. I have included her in this email so
that you have her email address so that you may contact her directly with
any further questions regarding your request.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Muckrock Staff
To Whom It May Concern:
I'm following up on the following Florida Sunshine Law request, copied below, and originally submitted on July 18, 2023. You had previously indicated that it would be completed on Oct. 27, 2023. I wanted to check on the status of my request, and to see if there was a new estimated completion date. You had assigned it reference number #20231027.
Thanks for your help, and let me know if further clarification is needed.
From: Union County School District
In a recent followup dated August 11, 2023, it was stated the MIS Director at the time, followed up with two members of the critical response team on each event.
1. Please give the name, title and email address of these members that were contacted from the team, the MIS Director's name and email address when the breach occurred , the date they were contacted by the MIS Director and the content of the meeting regarding EACH event. A statement will be requested from these individuals.
Assumed breach identified by CIRT Member Lanier Clyatt - MIS Coordinator - clyattl@union.k12.fl.us - May 19, 2022
Chris Mecusker - Director of Personnel - Mecuskerc@union.k12.fl.us - May 19, 2022
2. Please send the names and email addresses of those reported as creating the breach.
Peggy Vermont - vermontp@union.k12.fl.us
3. Also, this is by no means saying the information is not correct but just wanted to confirm for the official record responded to on August 22, 2023. As of the date of the second breach reporting, October 31, 2022, the official statement is no other emails or document sharing occurred between the individuals that created the breach after this reporting date. This is not saying the information is not correct but it seems rare that the email and communications between the individuals involved in the breach ceased on the same day the breach was reported. Is that still the official statement?
After IT further investigated, while the second breach was reported October 31, 2022, the last sharing or communication was August 30, 2022 prior to the second breach notification.
From: FOIA Disclosure Group
Thanks so much for your response.
Your response dated August 11, 2023 and later mentions by name, MIS Coordinator (or Director in other responses from December 4, 2023 response) Lanier Clyatt as the one who met with two members of the team.
In the December 4 2023 response the names and positions of MIS Coordinator and Chris Mecusker, Director of Personnel, were the two that the MIS Coordinator contacted. That is really one member contacted for an opinion on the breach being valid to report to those affected or are we misunderstanding your response correctly?
Also in the August 11, 2023 response it was stated the Superintendent determined the documents that were categorized as FERPA content was not critical and now the MIS Coordinator or Director that in this same response date was the one that reported it. This is confusing as the MIS Director would have reported it if it was not critical to begin with.
Please send this request below to the members you mentioned.
MIS Coordinator - clyattl@union.k12.fl.us
Director of Personnel - Mecuskerc@union.k12.fl.us
Request starts on next line
You are being included as part of a public records request.
Your information was obtained from a request sent to your entity regarding a data breach.
Please verify that you as a committee member were contacted regarding these breaches.
If there were any documents, meeting notes or email regarding this meeting or sharing information regarding these breaches please include them.
Please give the date of the meeting and the location.
As it stands there were only the MIS Coordinator and Director of Personnel that made the decision that the breaches were not critical. Please state according to the records release how the decision was made and how your CIRT document supported this decision.
You may view the discussion of the public records request here.
https://www.muckrock.com/foi/union-county-10464/untitled-149460/
Thanks in advance for your assistance.
Freedom of Information Act Disclosure Group
From: Union County School District
My apologies for the confusion, former MIS Coordinator, Lanier Clyatt and Director of Personnel, Chris Mecusker, were the only members of the CIRT aware of this incident.
Please see the attachments which include the communications Mr. Mecusker provided regarding the incident.
Mr. Clyatt is no longer employed with the District.
The District will not be providing any information that does not already exist in a record as defined by Florida Statute 119.011. By answering questions or providing statements, we are creating a record that does not already exist.
From: FOIA Disclosure Group
Thanks for your response and documentation. Mr. Clyatt's contact information was located on a database available so an attempt will be made to contact him as he was involved at the time. If he responds his information will be placed in this request as well.
Also, there is a lot of redaction. Could you give a brief explanation in general why it was necessary?
Some look like they might be student names and while that is defined in your state as directory information there is no intention to obtain that. However all other names and email address of adults that seem to be referred to in the emails are public record and should be to be un-redacted and resubmitted please.
From: Union County School District
Thank you for your request. It is being forwarded to our Custodian of
Records, Mrs. Cailyn Stalnaker, for review. If you have further questions
regarding this request, please contact Mrs. Stalnaker at mis@union.k12.fl.us
.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: Union County School District
Please see attached. I reached out to FERPA and was told I did not have to redact the interns information.
From: FOIA Disclosure Group
Thanks for your response.
From: FOIA Disclosure Group
Below is the information received from Lanier Clyatt.
Beginning of response
In response to your request, union-county-10464/untitled-149460/
My responses will be limited to responses that were not accurate from the district. All in all after reading the thread the district has been mostly transparent regarding this request. I was the MIS Director at the time of both of these events.
1. There were 2 breaches. Over one thousand records were released to a third party's private email address, intentionally after the bad actor was instructed, in an email, to not share any information. The information was highly confidential, exceptional education student records, protected under FERPA.
2. The district did not follow the breach process that was in effect. LinkThe committee did not meet and parents were not notified.I did not notify the evaluation team, only the Superintendent, on each event.
3. The discussion between myself and Mr. Chris Mecusker (there was no committee meeting) was simply me giving him background information on the situation and a brief discussion on the emails I was about to forward to him regarding the breaches. There was not a discussion of this not being a breach as the district mentioned. Furthermore the district process does not mention that as an option (random members of a partial committee breach assessment team making a decision) for assessing a breach.
4. Any document signed by an individual about the release of student information, whether a sanctioned district approved document or not, is not a defense for the willful release of protected student information. The document mentioned in the email, over a year after the event. was not district sanctioned.
End of response
From: Union County School District
Your response has been received and is being forwarded to our Custodian of
Records, Mrs. Cailyn Stalnaker. If you have further questions or responses
please send them directly to Mrs. Stalnaker at mis@union.k12.fl.us.
--
Mike Ripplinger
Superintendent of Schools
Union County School District
55 SW 6th Street
Lake Butler, FL 32054
352-448-5054 (Office)
386-867-9038 (Cell)
--
Please Note: The information contained in this e-mail message, and any
attachment thereto, may be confidential and may not be disclosed without
the express permission of the Union County School District. If you are not
the intended recipient or an employee or agent responsible for delivering
this message to the intended recipient, you are hereby notified that you
have received this message in error and that any review, dissemination,
distribution or copying of this message, or any attachment thereto, in
whole or in part, is strictly prohibited. If you have received this
message in error, please immediately notify us by e-mail and delete the
message and all of its attachments. Any email that is not considered
confidential may become public record under Florida Statute.
From: FOIA Disclosure Group
Please consider this request as completed and closed.
Files
pages