Several current and former Williamsville North High School students are believed to have broken into the school district's computer system last month and copied secure files that included the personal information and Social Security numbers of school employees, authorities say.
This computer breach marks the third time in the past month that students have gained unauthorized access to sensitive information in area school districts.
Students in the Grand Island and West Seneca districts have been charged with unauthorized computer use.
"From talking with staff and from talking with students involved, we know these students gained access to personal information regarding employees of the school district," Amherst Police Chief John Askey said.
The students, Askey said, overrode the security defenses of a classroom computer at Williamsville North and went trolling for information.
"They actively attacked the system . subverted those security procedures and precautions," he said.
He added that several of the hackers are considered "very bright kids" and good students with no lengthy disciplinary records.
The extent of the security breach remains unknown because police are required to have computer evidence extracted by the Western New York Regional Computer Forensics Laboratory, Askey said, which might take several weeks.
But he added that police know the students may have accessed personal staff data. This prompted Superintendent Howard S. Smith to send a letter this week to the district's 1,800 employees, asking them to notify Amherst police if they uncover any suspicious credit card or banking activity.
So far, however, police and school officials say they have no evidence that any of the accessed data has been distributed or used to commit crimes. Employees or students who suspect their private information might have been used improperly should call the police at 689-1311.
District computer technicians noticed some unusual activity during routine monitoring of its network on March 26, Smith said.
"Immediately upon getting the information, we began our investigation and involved the police," he said, "and they have been working with us ever since."
Two school computers, four personal student computers and one portable flash drive have been confiscated as part of the investigation, Askey said.
At least three individuals are suspected in the breach, he said, and several more knew about it. Those involved have told police they simply were interested in how far they could get into the system.
Smith said the district has begun disciplinary action against one student and expects to take further action as the police wind up their investigation. He added that the district also has taken steps to improve security.
Those involved might face charges that include unauthorized computer use, stealing and possessing confidential information and using the information to commit other crimes.
"There are several charges, mostly misdemeanors, that could result," Askey said.
In previous security breaches, a Grand Island High School student was arrested in March on charges of unauthorized use of a computer. State police said he hacked into the school computer and accessed user names and passwords of school staff. Investigators say they don't believe he used the passwords.
At West Seneca East High School, two 18- year-olds and a 17-year-old were charged April 1 with unauthorized use of a computer, Police Chief Edward Gehen Jr. said. The students obtained an administrative password, he said.
"It doesn't look like any sensitive information was compromised," he said.
The mother of another West Seneca East student said her son was suspended April 2 for improper computer use. He was in the library surfing an online auction site and did not break into the school computer system, she told School Board members.
"They're trying to charge him with hacking," she said.
The police chief declined to say if the investigation involves the woman's son.