Southeast Middle School

Summary

Virtual learning disruptions occurred at multiple North Carolina schools, including Southeast Middle School, where unauthorized individuals accessed online classes to display inappropriate content, shout obscenities, and use offensive language directed at students and teachers. The intrusions stemmed from publicly shared meeting links and compromised credentials, with incidents reported at Millbrook Magnet High School, Oberlin Magnet Middle School, Lee County High School, and the aforementioned institution. In some cases, non-student accounts gained entry to virtual sessions, prompting swift removal by instructors. School districts responded by securing shared links, investigating breaches, notifying parents, and identifying at least two students involved in one incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In August 2020, multiple North Carolina school districts experienced disruptions during virtual learning sessions, including an incident at Southeast Middle School in Kernersville, part of the Winston-Salem/Forsyth County Schools district. During a virtual art class, an unauthorized participant gained access and yelled obscenities, disrupting the session. The Winston-Salem/Forsyth County Schools district initiated an investigation into the breach and notified parents of affected students. This incident occurred amid broader disruptions across the state, with similar events reported at Millbrook Magnet High School in Raleigh, Oberlin Magnet Middle School, and Lee County High School in Sanford. At Millbrook Magnet High, at least 20 staff members reported intrusions where hackers used offensive language and directly insulted students and teachers, while a non-student account accessed a Lee County High School class to share inappropriate content before being removed by the teacher.

The Wake County Public School System attributed the Millbrook and Oberlin incidents to Google Meet session links being publicly accessible, enabling unauthorized individuals to join classes. Two students were identified as involved in the Millbrook disruptions, with their parents notified. School districts implemented corrective measures including restricting link sharing to enrolled participants only. The North Carolina Department of Information Technology’s Chief Risk and Security Officer, Maria Thompson, publicly advised schools to avoid publishing passwords, vet participants, refrain from password reuse, and distribute credentials exclusively to intended users. These coordinated disruptions highlighted vulnerabilities in virtual classroom access controls during the early phase of widespread remote learning adoption.

Sources

Sources available to members: 1 source.