Florida Virtual Learning School

Florida Virtual Learning School, also known as Florida Virtual School or FVLS, operates within the United States of America. The organisation provides educational services, evidenced by its association with students and teaching staff. Its core activities involve facilitating learning for a significant student population across different locations.

The organisation experienced a significant cybersecurity incident involving a third-party vendor. On May 2, 2016, an unsecured server belonging to this vendor exposed highly sensitive personal information. This breach impacted approximately 368,000 current and former students affiliated with Florida Virtual School, alongside data pertaining to over 4,000 teachers and staff from Leon County Schools. The compromised records were stored in plaintext and included Social Security numbers, addresses, contact details, academic information, vaccination histories, disciplinary reports, and parent data. This data was accessible without any authentication controls for an extended period, indicating a critical failure in data protection practices. The exposure was discovered by an independent researcher and subsequently reuploaded by a forum user who alerted authorities, contradicting the vendor's later assertion that the incident resulted from external hacking. Forensic evidence strongly suggested the compromise stemmed solely from inadequate access controls implemented by the responsible party, not external exploitation. Despite publicly sharing portions of the dataset, the vendor involved offered assistance to secure the affected systems following the discovery. This incident underscores the substantial risks associated with third-party data handling and the severe consequences of insufficient security measures for sensitive student and staff information.