Cyber Incident Victim: New Drop High School
Date:
Dec 2014
Location:
United States of America
Summary
A student at New Drop High School exploited system vulnerabilities to alter his academic records via unauthorized access from a personal smartphone, leading to criminal charges including forgery and computer trespass. The breach was detected by IT personnel monitoring irregular logins, with investigations revealing the individual utilized programming skills acquired at a specialized camp to bypass security measures, resulting in legal proceedings while maintaining his status as an otherwise average and disengaged student.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In December 2014, Eric Walstrom, a 16-year-old junior at New Dorp High School on Staten Island, allegedly bypassed password protections and security software using a school computer to gain unauthorized access to the school's administrative systems. Between December 14, 2014, and February 9, 2015, Walstrom modified his academic records—including report cards and transcripts—to improve his grades. He configured the network to enable remote access via his smartphone, allowing him to execute changes outside school premises. The intrusion was detected when a school IT employee noticed unauthorized logins to the system, triggering an internal investigation. The school administration reported the incident to law enforcement, leading to Walstrom's arrest on February 25, 2015. He faced adult charges including computer trespass, computer tampering, unauthorized use of a computer, forgery, and criminal possession of forgery devices. The criminal complaint explicitly cited his alteration of grades as the basis for these charges. No evidence suggested he accessed or modified other students' records.
Walstrom had acquired advanced programming skills through attendance at the iD Programming Academy for Teens, a summer camp hosted at multiple universities that taught Java, C++, and infrastructure programming. Fellow camp attendee Sean Morris confirmed Walstrom applied these skills maliciously to bypass security systems. School peers described Walstrom as an academically average, introverted student with limited engagement in school activities. New Dorp High School had received predominantly "good" ratings in a 2014 Department of Education survey, with a four-year graduation rate of approximately 75%. The incident drew attention to vulnerabilities in the school's network security, though no systemic weaknesses or prior breaches were disclosed. Walstrom's family background included his father, a firefighter who participated in 9/11 rescue operations and died of illness in 2013. The school did not publicly announce policy changes or security upgrades following the incident.