Breach at Testing Company Allows Access to 52 Students’ Data

NEW YORK — A data breach at the company that develops New York state’s third-through-eighth grade reading and math tests allowed an unauthorized user to access information about 52 students who took the tests by computer last spring, the state’s Education Department said on Thursday. The data that was viewed included students’ names, state student-identification numbers, school names, grade levels and teacher names.

State officials said that the company, Questar Assessment, believed a former employee gained access to the information.

The 52 students attended five schools in different parts of the state. In total, roughly 88,000 students around the state took tests by computer last spring, including those who took field tests, which allow the test developer to try out new questions.

In response to the breach, the state Education Department said that it had required Questar to reset passwords on all user accounts and close accounts of former employees, which the department said the company had done. The department said it had also demanded that Questar submit a plan detailing how it will prevent such breaches in the future and commissioned an independent audit of its systems and security policies.

The department said it had referred the matter to the office of state Attorney General Eric Schneiderman, and a spokeswoman for Schneiderman said the office had opened an investigation.

“We’re working very hard to hold the responsible parties accountable and, most importantly, to make sure this never happens again in New York,” the state education commissioner, MaryEllen Elia, said.

Elia said that Questar said students in another state were also affected by the breach, but she had no further details.

Brad M. Baumgartner, Questar’s chief operating officer, said in a brief interview that he could not discuss contractual matters involving other states. In an emailed statement, he said, “Though access was to a very minor amount of data, any unauthorized access to data is unacceptable.” He said that the company “intends to cooperate fully” with the state Education Department.

New York state in 2015 awarded a five-year, $44 million contract to Questar to develop its tests and provide platforms for administering the tests by computer. (Currently, schools can choose whether they want to administer the tests by computer or with pencil and paper.) The state’s previous test developer had been Pearson, an international educational company that had become a lightning rod in the debate over standardized testing.