Schoolgirl hacked pupil files

An elite Perth girls school is reviewing its digital security after a student hacked into pupils' confidential information that was visible only to teachers and distributed it using social media.

Presbyterian Ladies' College principal Beth Blackwood confirmed yesterday that a Year 10 student hacked the Peppermint Grove school's computer database and accessed records available to teaching staff. She then sent some students copies of their own personal records via social networking sites Facebook and Snapchat.

"We have different levels of security, so some of those records that were accessed were available to general teaching staff, but she also accessed some that were restricted in their distribution," Ms Blackwood said.

The information the student viewed included general comments written by a counsellor to advise staff of matters relevant to students' pastoral care and wellbeing, such as friendship problems or a death in the family.

But it did not include confidential details shared in private counselling sessions.

Ms Blackwood said she became aware of the extent of the breach a week ago but did not know exactly when it had occurred.

The student, who has been suspended for two weeks, had not used a school-issued laptop to get into the database.

The school called all Year 10 students to a meeting on Thursday to discuss the security breach. "We asked the students that had concerns, or had been privy to accessing files, to come forward and speak to us," Ms Blackwood said.

"Our understanding is there were no more than 10 students who had information electronically distributed to them."

Parents of affected students had also been contacted.

Some parents had been concerned about the nature of the information that was on the database, but Ms Blackwood said it was kept in accordance with the school's privacy policy.

"I do not believe there was anything in the information that was on the database that was not in the best interests of students," she said.

"All systems are vulnerable to being breached, but in 18 years this is the first occasion I've ever had to manage a breach of the security."

The school had since secured the computer system and was reviewing and enforcing digital security procedures.