News

LMSD Absence Request Form Malfunctions

A photo of the top portion of an email that one student received. The email was similar for all students.

This is a developing story and will be updated. Please continue to check back as we obtain new information.

On Wednesday the 24th, thousands of students around Lower Merion School District awoke to a strange message in their school email inbox. “Thank you for reporting the absence of your … student. You may receive a phone call from the District indicating that your student is absent.” LMSD says they have determined that the district network was not hacked or compromised, but are still investigating the cause of the issue.

Normally, a note such as the one depicted above would indicate that the student or their parent had requested an absence using LMSD’s online absence request form. However, that was not the case. The requests were made by a mysterious third party.

Most students received the email between 1 AM and 5 AM the morning of the 24th. It is still unclear what the cause of the malfunction was. The email contained a short manifesto-like blurb leading some students to speculate that an angered parent submitted the requests. It read:

The Safe Arrival system is an unsecured danger to LMSD. Students are easily able to sign themselves out and it is an unacceptable danger to the safety of district schools. Administration has demonstrated an unwillingness to act as students engage in flagrant truancy. To fix these problems we ask that:

1. A CAPTCHA system be implemented on the safe arrival form
2. A database of valid parental emails be implemented with 2FA for all absences
3. The safe arrival form be blocked on LMSD networks

The email varied slightly from student to student. For some, it stated that the request was for an early dismissal instead of an absence. The date the request was for also varied but tended to be a date within the next few weeks.

A photo of the email that one student received.

Harriton TV estimates that over 4000 students around the district received the email and is working to confirm the actual number. We confirmed in the afternoon of the 24th that students from both Middle and both High Schools received emails.

Update 4/24 at 11:30 AM: LMSD released a full statement in regards to the issue. The statement can be viewed below:

Good morning, LMSD Families,

This morning, we were made aware of emails that were sent to some students regarding the LMSD Safe Arrival absence-reporting website. The District’s Information Systems Department is investigating these emails, but has determined that District computer and network  systems  have not been hacked or compromised.

Our other District systems (PowerSchool, etc.) are not affected in any way. If you received a call or email this morning that has you concerned about whether your child is safely in school, you may call your school office to check.

We apologize for any concern or inconvenience that these emails may have caused.

Yours truly,

Amy Buckman
Dir. School and Community Relations

Update 4/25 at 5:00 PM: LMSD released a second public statement with additional information about the emails. Viewable below.

Dear LMSD Families:

Yesterday we shared information with you regarding errant emails that were sent to some secondary students’ email accounts from the LMSD Safe Arrival website.

Our Information Systems Department followed up with our website provider and was able to identify the IP address that generated the emails. The IP address was blocked, as were all IP addresses connected to the service provider. Further legal steps are under discussion.

Again, we want to stress that these emails did not compromise our District systems, such as PowerSchool.

Here’s what we think happened. It is likely that a student (or a parent/guardian with access to a student’s email account) auto-populated the LMSD Safe Arrival form with a message and with email addresses to which they have access. The system then sent confirmation emails to those addresses.

This was possible because all students with LMSD email accounts have access to other students’ LMSD email accounts, as explained in the District policy which parents/guardians sign prior to their child’s account being activated. You can review that here: https://www.lmsd.org/departments/technology/coppa/6-new.

To prevent this from happening again, we have adjusted the LMSD Safe Arrival system, so that confirmation emails will no longer be sent. Discontinuing confirmation emails will allow us to continue to offer the convenience of online absence reporting without running the risk of errant emails.

Again, we apologize for the inconvenience yesterday’s emails may have caused. If you have further concerns, feel free to contact Mr. George Frazier, Director of Information Systems, at 
[email protected].

Yours truly,

Amy Buckman
Dir. School and Community Relations

This is a developing story and will be updated. Please continue to check back as we obtain new information.


Harriton TV is a student-run news organization. Posts to Harriton TV’s Website do not necessarily go through an approval process by Harriton faculty.

Avatar
About author

Sam Catania is the Co-President of Harriton TV and Director of the Ram Report. He acts as lead producer all events. His passion for news and journalism was initially ignited by Ricky Sayer in 9th grade and has continued to grow ever since. At his core he believes in factual and ethical reporting.
Related posts
NewsSportsSpotlight

The Ram Report 11/14/19 | S5E6

News

Submit A Question: LMSD School Board Candidate Forum

News

PA Senator Leach Disinvited from LMSD Legislative Forum

NewsSpotlight

Architects Present Initial Drawings for New Middle School

Sign up for our Newsletter and
stay informed

Leave a Reply

Your email address will not be published. Required fields are marked *