Data breach in Arizona school vouchers program traced to ex-employee

PHOENIX — A data breach that allowed a parent to see information about other parents getting vouchers can be traced to a now-resigned employee of the Arizona Department of Education, a new report says.

The state Homeland Security Department says there was an “email chain’’ between an unnamed employee at the agency and the parent in late June about an order the parent had placed for items or services for a child through ClassWallet, the private firm hired by the state handling such requests.

State schools chief Tom Horne confirmed for Capitol Media Services that the employee, who resigned a week ago, was Christine Accurso, whom he had hired to run the voucher program.

According to the report, Accurso said she had looked up the parent’s order and noticed it had been assigned to her and not to the parent.

That led to the parent getting “elevated user permissions’’ allowing access to everyone else in the approval queue. Accurso’s account was then used to access ClassWallet to conduct a search for the student’s account and view the details, including permissions to view various files.

But it was not the Department of Education that reported the data breach but the state Treasurer’s Office, which handles the disbursements. That report occurred only after the Yellow Sheet, a publication of Arizona Capitol Times, reported a claim by a parent whose child is a voucher recipient that she was able to access thousands of purchases by other parents in the program through her ClassWallet account.

On July 24, three days after the probe began, Accurso abruptly resigned.

In a statement to the media, Accurso did not cite a reason, saying instead that “it is time to move on and pursue other opportunities to engage citizens, especially parents, to fight for school choice and other issues they believe in for the future our our state.’’

A spokesman for Horne said he is legally precluded from providing a copy of her resignation letter. But the schools chief, in a statement Tuesday, said he did not know until the report about Accurso’s involvement in the breach.

“The Arizona Department of Education has no way to know the reason for the resignation of Christine Accurso other than her own statements in her letter of resignation,’’ said Horne, a Republican elected in November. “The department did not request this resignation; it was initiated by the former employee.’’

Horne also pointed out Accurso resigned before the investigation was completed.

The breach

The Homeland Security report said the parent could access the full name of each student and parent, the email of the person placing an order, home shipping address, amount spent per order, items purchased per order and the phone number of that person. Having that information could tell someone with unauthorized access a lot more, the report said.

Back to homepage

Subscriber Login

Keep reading with a digital access subscription.

Subscribe now

“The application type could be used to infer that the student may have a learning disability,’’ the report states.

In an earlier statement, Jamie Rosenburg, CEO of ClassWallet, said the problem had been solved.

“It was a permission setting error,’’ he said. “Once discovered, we took immediate action and corrected the permission setting.’’

Rosenburg said a search of the database concluded no other users were affected, calling it “an isolated incident to a single user.’’

The issue of the voucher program and how it is run has taken on new importance since the decision last year by the Republican-controlled Legislature to make vouchers of public funds available to any student to attend private or parochial schools or for home schooling. Until then, these funds were available only to certain students, such as those with special needs, foster care children and students attending schools the state rates as D or F.

The result has been a sharp increase in the number of Arizonans asking for what are formally known as “empowerment scholarship accounts’’ of about $7,200 a year, with some predictions that the total enrollment, which had been around 12,000 before the restrictions were lifted, could balloon to close to 100,000. Much of that increase has been in students who already were enrolled in private schools at parental expense.

Horne is a big supporter of vouchers. That was reflected in his hiring of Accurso, who promoted universal vouchers, to the point of discouraging voters last year from signing petitions that would have put the question of expansion on the ballot.

On Tuesday, Horne defended hiring her.

“She has, in fact, cleaned up an unbelievable mess,’’ he said. “There were 170,000 bills that hadn’t bee paid. There were bills, unpaid, going back to June, not of 2022 but of 2021.’’

That was when the department was being run by Democrat Kathy Hoffman, whom Horne defeated last year.

“And now they’re being paid within a reasonable period of time,’’ he said.