Schools Gmail account possibly hacked?

[Smee]

A school that I work for has just called me in a fluster. Apparently they use a Gmail account to email parents and sent out a newsletter this morning. They have just been contacted by a parent to say a second email went out with all their (the schools) pupil information from what looks like SIMs. No one in the school sent the email, it's gone to all parents! Massive breach of data. Is this possible? I didn't even know they had a Gmail account, they use rm easymail for everything else. Can anyone shed any light on what may have happened and how to stop it happening again. I have no knowledge on this :/

[mowgli82]

So two things have been "hacked" the gmail account and someone has managed to get in to SIMS and run a report and then email out? have you seen a copy of the email and the data that went out?

[Smee]

No I've just had a panic phone call from the schools office

[Michael]

The obvious thing would be for said parent to forward the e-mail back to you for inspection.

 

Also, if they did a bulk e-mail, did they BCC everyone? It's a mistake I've seen before!

[mowgli82]

Until you can ascertain what has happened these are the steps I would take.

 

Do they have access to SIMS remotely? disable it!

 

Change the passwords of all user and admin accounts, change the gmail password. If you feel the network has been compromised unplug it from the internet

 

Get a copy of the email.

[theeggmaster]

Also log into the GMail account and look at the Sent Items to see if it was actually sent from that account. Check the deleted items too.

[Smee]

I've just spoken to the school again. They have the techie people from their education authority checking it out, their admin machines are support by them. They can't even see where the email was sent from so have asked one of the parents to send it back to them. The only remote access is from the authority's support team. Thank you all for your advice

[TwistedHelixis]

Depending on the data you might need to inform the ICO.

 

We had something like this, in the end it turned out to be someone in the office accidentally sending an email for our Local authority to an all parents email group and then to make everything worse trying to hide they had done it.

[Smee]

Just got off the phone from the school. The now have the police involved. Thanks for all your advise

[asc]

2 factor authentication should be switched on for that Gmail account. Either set it up with a PAYG mobile in the office or buy a few U2F USB security keys for the staff that want to use it.

[Arthur]

Either set it up with a PAYG mobile in the office or buy a few U2F USB security keys for the staff that want to use it.

The U2F keys or a TOTP app would be the best option. SMS (even with 2FA) should be avoided.

 

Adding a phone number to your Google account can make it LESS secure

 

In order to secure your Google account, you should really enable two-factor auth, and use either a U2F/FIDO device, or a TOTP app like Google Authenticator, Duo, or Authy. If, for whatever reason, you don’t have two-factor authentication enabled, I would strongly recommend not adding a backup phone to your account as it could ironically reduce the security of your account. SMS-based two-factor auth is risky also: if an attacker can convince your telco to turn over your phone number to him/her, he/she will have access to your two-factor codes as well.

 

US standards lab says SMS is no good for authentication

 

America's National Institute for Standards and Technology has advised abandonment of SMS-based two-factor authentication.

[Smee]

I'm afraid to say (but also relieved :/) that the issue is now believed to have been human error. Some very hard lessons have been learned. Once again thank you all for your advice and support.

[mikeprice]

Thanks for letting us know - it is worth knowing in case it happens to others and we will know what to look for