Student accessed Inna accounts and tried to alter school records

A student accessed staff and other students’ accounts in Inna, the shared registration system for Iceland’s upper secondary schools, and tried to change grades and attendance records, mbl.is reported. The security breach was discovered last week.

“We saw quite a few unusual entries, and other schools saw them too. The Data Protection Authority has received reports from several upper secondary schools,” Sólveig Guðrún Hannesdóttir, principal of Menntaskólinn í Reykjavík, told mbl.is.

She said an employee at her school noticed changes to records in their account that they had not made. The entries appeared to include attempted changes to grades, attendance and other information. A student at another school may also have been able to view students’ personal information, she said.

Sólveig said she expected Inna to have fixed the vulnerability, as the system had reopened a login method the school previously used. However, the school had not received an analysis of what information had actually been changed. It had reported the incident to the Data Protection Authority, as had Inna, and was seeking more details about the records involved.

This is the second time this year that Menntaskólinn í Reykjavík has been affected by an Inna security breach. In the earlier incident, a student alerted the school and sent a detailed report explaining how to access the system. The school reported the issue to Inna and the Data Protection Authority. No information was changed in that incident, Sólveig said.

She said the repeated incidents had left school staff uneasy about relying on the system, which holds extensive records about current and former upper secondary students across the country. “We don’t quite trust the system when this has happened twice in the same year,” she said, adding that someone could potentially copy sensitive, identifiable information.

The Data Protection Authority confirmed to mbl.is that it was handling the matter. Its director, Helga Þórisdóttir, said incidents involving a possible security breach or unauthorised access to information must be reported to the authority.