A massive security flaw in the Baltimore County Public Schools allowed unrestricted access to highly sensitive records pertaining to students, staff and internal school system data. The system’s BCPS One/Schoology platform where anyone with a password – including students, parents, and staff members – can access to personal student and staff member information, as well as some sensitive school system records, was the source of the breach.

"The public website of Baltimore County Public Schools (BCPS) was found containing a major security flaw that exposed highly sensitive information on students and staff members. Anyone with login credentials was able to access the personal information of other students and staff members, as well as certain sensitive school records. A total of around 11,400 students, parents, and staff members, who have access to the platform could view these records. It was not known for how long the records have been exposed through the platform and whether any unauthorized party gained access to it.