A vendor contracted by the Boston public school system to print student identification badges lost a flash drive containing data on 21,000 middle and high school students, forcing the school system to redesign the badges to prevent the lost data from being misused, officials said.
The lost drive included students’ names, ages, grades, and ID numbers on files that are used to print OneCards, the school system’s student identification badges, officials said. The drive did not contain student addresses, phone numbers, Social Security numbers, or birth dates.
School officials said the data was lost last week by vendor, Plastic Card Systems Inc. of Northborough. School officials began notifying parents by letters and automated phone calls Monday, after a frantic weekend of searching.
“The loss of any student data by a vendor is a serious breach of protocol, and we want to be sure our families know exactly what happened and what we are doing about it,” interim Superintendent John McDonough said.
The drive was lost sometime after midday Friday, when Donald W. Axline, president of Plastic Card Systems, arrived at the Boston School Department headquarters on Court Street to pick up a box of blank OneCards, said city schools spokesman Lee McGuire. Axline also picked up the flash drive.
Officials believe the drive fell out of Axline’s pocket somewhere between School Department headquarters and his company’s offices, McGuire said. When Axline arrived at his office, he realized the drive was missing. The School Department was notified that day.
Teams from the School Department and the vendor spent the rest of the weekend searching, but to no avail. The drive may have been washed into a gutter by Friday’s rain, McGuire said.
Along with names and other information, OneCards have a Boston Public Library card number, MBTA CharlieCard number, and a pass for Boston Centers for Youth and Families community centers, officials said. About two-thirds of the cards also have a photo.
Officials believe there is no password or other security measure protecting someone from getting access to the data on the lost drive.
But McGuire said that because of changes the School Department has made since the drive went missing, none of the data or numbers on the drive can be used fraudulently to, for instance, make working counterfeit library or T cards or to get access to student records.
The flash drive contained PDF image files that are used to print student ID badges that the school system administers at the start of each academic year: 21,054 OneCards, which go to students in grades 6 through 12 across 36 schools, officials said.
School staff scan the badges each morning to track attendance.
Students who attend elementary schools, K-8 schools, and standalone middle schools do not receive IDs and were not affected by the lost data, officials said.
Plastic Card Systems Inc. was selected in June through a competitive bid process to manufacture the OneCard, McGuire said, winning a $48,000 contract.
“They have a good reputation and a good track record nationally,” he said.
Though they expressed concern about the lost data, school officials also pointed out that students frequently lose their badges, possibly exposing their data. Last year, the department deactivated about 18,000 OneCards due to the badges being lost, broken, or malfunctioning.
The episode has also led Boston public school officials to discuss how they handle data. McGuire said the School Department typically transfers files and data over a secure online connection, rather than using a flash drive.
“Our IT department is, going forward, looking to see what is the best protocol we should follow for transmitting that kind of data in the future,” he added. “We recognize there are better methods.”
On Tuesday, officials at Plastic Card Systems referred requests for comment to a lawyer, John J. McMaster, who did not respond to messages. In a statement, Axline, the president of the company, apologized.
“Plastic Card Systems deeply regrets the unfortunate accidental loss of the Boston public schools student data files, and we understand how families will be upset, as we are upset, by the situation,” he said. “We will make all efforts to help Boston public schools in addressing this situation and will assist in any way possible to quickly rectify the situation.”
School officials said affected families do not need to take any action. New OneCards will be issued on time at the start of the school year.
McGuire said school officials and the vendor are in conversation about having the vendor compensate the School Department for what officials expect will total “several thousand dollars” in extra costs to redesign badges, send letters, and to provide extra personnel to answer parents’ phone calls.
Plastic Card Systems will make the redesigned badges, McGuire said.
“We’re satisfied with how the vendor is responding,” he said. “The vendor has been very cooperative.”
To select another vendor would require going through a bidding process that would probably extend past the start of classes next month.