According to a declaration made to state regulators, an education technology business that developed an app to allow Los Angeles kids to access telehealth services during the school day has had a data breach that jeopardizes the privacy of students.
In addition, Kokomo Solutions offers an anonymous tip line for members of the Los Angeles community to report suspicious activity, safety hazards, and mental health emergencies to the police department of the school system. An unidentified number of people’s personal information was compromised after an unauthorized third party gained access to the company’s computer network, according to a data breach notice filed with the California attorney general’s office on August 5. The files that were exposed were related to the Los Angeles Unified School District.
The business, which goes by Kokomo24/7, claims that it found out about the illegal access on December 11, 2024, almost eight months before informing the victims of what had transpired. The district hasn’t made any public announcements warning families and students that their private data might have been exposed.
The incident raises red flags because there’s no doubt that [Kokomo is] managing extremely sensitive information about campus safety issues and students’ medical information, according to school cybersecurity expert Doug Levin, even though many details about the breach are still unknown, such as the precise types of information that were compromised and whether the breach was the result of a cyberattack.
According to Levin, co-founder and national director of the K12 Security Information eXchange, this is just another instance of schools contracting out the gathering and administration of extremely sensitive data on their communities, which, if misused, might compromise their health and safety. Knowing more about how they were compromised and how they plan to solve it would be beneficial to us.
Requests for comment from the district were not answered. Neither did Kokomo24/7, which has reportedly removed all mention of its work with the country’s second-largest district from its website in recent days.
Receive the most important news and information regarding the safety, rights, and general well-being of students directly in your inbox.
Students, parents, and other community members can report suspicious behavior, mental health crises, drug use, drug trafficking, vandalism, and safety concerns to the district’s 268-member police department through the Los Angeles Schools Anonymous Reporting app, which was introduced in 2023.
In the same year, Kokomo, the Children’s Hospital Los Angeles, and Hazel Health entered into a deal with Los Angeles schools to introduce new district telehealth services. The $800,000 program, which was made possible by government pandemic relief funds, aims to give kids access to app-based mental and physical health services, including while they are in class. While Kokomo24/7’s services concentrate on physical health issues, such as minor injuries, allergies, and headaches, Hazel Health offers virtual mental health treatments, according to the district’s website.
The district outlines its Kokomo24/7-managed telehealth program in a letter to parents that was last updated in July. It allows kids to get healthcare when they are ill during school hours under the supervision of a school nurse, all while staying in school and concentrating on their studies.
Daniel Lee, the founder and CEO of Kokomo, praised the firm in a blog post last year for its ability to revamp L.A. Unified’s COVID-tracking and health data system in just one year after the school system’s old tool became cumbersome, costly to operate, and hard to adjust. The article highlights the company’s contribution to the development of the district’s Incident System Tracking Accountability Report, an internal tool for recording injuries, medical emergencies, and threats on campus, as well as the anonymous reporting application.
The Kokomo24/7 hack is the most recent in a string of data privacy problems that have affected schools in Los Angeles, including a well-publicized ransomware attack in 2022 that exposed the mental health records of thousands of kids. After initially vehemently disputing that pupils’ psychological assessments had been made public, school superintendent Alberto Carvalho was forced to admit that they were The existence of the records on the dark web was discovered by the 74s inquiry.
Meanwhile, AllHere, the educational technology company hired to create the $6 million project, abruptly closed and declared Chapter 7 bankruptcy, delaying the district’s introduction of a much-discussed AI chatbot last year called Ed. Joanna Smith-Griffin, the company’s founder and CEO, was later charged with defrauding investors out of approximately $10 million. According to a company whistleblower, The 74AllHere’s student data protection procedures were against district policies as well as industry norms.
Before giving the contract to AllHere, the L.A. district evaluated three bidders for the chatbot, including Kokomo24/7. The criminal and bankruptcy cases are still pending. Ed is still on hold, a school district official told The 74 in July.
A vast array of items, mostly related to physical security, such as visitor management tools, emergency alarms, and building access control systems, are listed on the Kokomo24/7 website. It also lists well-known businesses as clients, such as the Oscars. The business provided health and safety software for Fifth Third Bank and United Airlines subsidiary United Express for the 2022 Academy Awards.
Records in the GovSpend government procurement database, however, indicate that the Illinois-based corporation has a comparatively tiny presence in the education sector. One of its few school district customers is the Hartford, Connecticut, school system, where teachers paid over $60,000 for licenses to the company’s Covid-19 Tracker between 2020 and 2023 in order to monitor student temperatures, track illnesses, and trace contacts. The company’s website also lists Glendale Unified, a district that is adjacent to Los Angeles, as a client.
Up until last week, Kokomo24/7’s ties to the L.A. district were prominently displayed on the company’s website. The debut of the anonymous reporting app for pupils and the emergency alert system for staff for the L.A. district in 2023 are two of the four foundational events noted in a timeline detailing the company’s 2018 inception.
This week, the company timeline was cleared of the mention of the school district, a banner that attributed a statement to Carvalho, an image of district police officers, and the logo of the district police department. Additionally, it seems that press announcements proclaiming Kokomo’s collaboration with the L.A. district have been removed off the internet.
The district deployment of its anonymous reporting app was deemed crucially significant by the since-removed Carvalho quotation. The statement, however somewhat misstated, originates from a school board meeting in March 2023 where Carvalho boasted about people’s ability to anonymously convey potential threats to a school or student.
Although the Los Angeles Schools Anonymous Reporting app has received mixed reviews, anti-surveillance activists sued it last year, claiming it strengthened police interactions between students of color and people with disabilities and fostered a culture of mass suspicion.
According to the Stop LAPD Spying Coalition, which brought the lawsuit to obtain information on the app, it allowed community members, parents, and students to monitor one another on behalf of school police and submit reports without the need for supporting documentation. It also asked why, as part of a larger initiative to look into suspicious activities, the community was being urged to report those experiencing mental health crises.
In a September 2023 article, the activist organization claimed that the app criminalizes mental health and reinforces the notion that people with mental illnesses are inevitably dangerous to others.
