Student Hacked School District to Get Advantage in Squirt Gun War

A student broke into Pennsylvania's Downingtown Area School District college preparatory program and obtained personal information including GPAs and SAT scores. They did it to get an advantage in a grade-wide squirt gun game, according to the Philadelphia Inquirer.

The data breach was discovered on October 11. Investigators said the suspect used a student portal called Naviance, which bills itself as a "comprehensive college, career and life readiness solution that helps districts and schools align student strengths and interests to postsecondary goals, improving student outcomes and connecting learning to life." They obtained teacher credentials for the system, with which they could access information that would normally be kept secure.

After the perpetrator was identified, investigators interviewed them and discovered that the hack was meant to gather information for "Senior Water Games," a popular activity also known as "Senior Assassin." In the game, each member of the senior class is given a target, and they must squirt them with water within 7 days before being squirted themselves. Once they eliminate a target, they are assigned a new one, and the last senior standing is the winner.

Young hacker using laptop
A young hacker using a laptop computer Suwat Rujimethakul / Getty Images

The district said that the hacker only extracted address information for members of the senior class, which they used to plan ambushes for Water Games targets. No social security numbers or credit card information were stored in the system.

Gary Mattei, the Director of Technology for the district, released a statement on Wednesday that read in part: "The consequences for these young individuals is likely to be severe. Cyber hacking is a federal crime and we are working with the proper authorities to determine the appropriate discipline and legal ramifications. Due to student privacy laws, we are not able to disclose more information but we can assure you that we are working within the full extent of the student code of conduct and the full extent of the law."

All district employees have been required to change their master login credentials, and the district will be engaging in an internal security review to prevent incidents of this type in the future.

As Water Games is an outside of school activity, the district does not have the ability to curtail it, despite the data breach. The district does have the option to press criminal charges against the hacker and their possible accomplices but had not determined whether they would be doing so as of press time.