Cyber Threat Actor: Laura Rose Carroll

LauraRose Carroll, also known by her alias, is an individual who was employed as an assistant principal at Bellview Elementary School in Pensacola, Florida, United States. She and her daughter, a student at Tate High School, were arrested by the Florida Department of Law Enforcement for unlawfully accessing the Escambia County School District’s FOCUS student information system. Carroll held district‑level access to FOCUS, which is used to manage student records, and her daughter used her mother’s credentials to interact with the system. The pair were charged with multiple felony offenses including offenses against users of computers, unlawful use of a two‑way communications device, criminal use of personally identifiable information, and conspiracy to commit these offenses.

The incident primarily targeted the education sector within Escambia County, Florida, focusing on the school district’s FOCUS platform. Carroll exploited her legitimate insider credentials to gain unauthorized access, while her daughter used those same credentials from devices linked to their residence, including a cell phone and home computers. No malware families, exploit kits, or specialized tooling were referenced in the reporting; the activity centered on credential misuse and repeated login attempts to manipulate homecoming court voting and view student records. The reported actions included casting 246 fraudulent votes for the homecoming court and accessing the records of 372 high school students, 339 of which belonged to Tate High School students, over a period beginning in August 2019.

No state nexus or affiliation with a criminal consortium was identified in the publicly available sources; the actors appear to have acted independently as individuals. The most notable publicly reported operation involves the unauthorized access to the FOCUS system, the manipulation of homecoming court voting, and the extensive viewing of student personal information that led to the arrests and felony charges. This case illustrates how insider credential abuse can be used to alter school‑based processes and compromise student data without the use of advanced malware or external intrusion techniques.