Parent-advocate says phishing email used a WPS administrator identity; requests public report

A parent advocate told the school committee that on July 30 a phishing or credential-harvesting email used the identity of a Worcester Public Schools administrator and that the district had not provided clear notice to affected families.

"At about 08:38AM, on July 30, a Worcester parent received what looked like a secure message from doctor Tammy Murray, director of special education," said Joey Ford, who documented the message and told the committee that the link led to an outside website asking for sensitive information. Ford said he contacted the special-education office and IT the same morning and was told the incident had been "dealt with," but multiple families reportedly received the message and at least one parent clicked the link. Ford asked the committee to require an expedited, de-identified public report describing scope, recipient counts, what records (if any) may have been exposed, and instructions for affected families.

Ford said an examination of the original message suggested it traveled within the district's Google environment rather than arriving externally, raising additional questions about the source. "Because we still don't know how that happened, we also do not know the full reach of the incident," he said. He said he had filed a public-records request for related documents and asked the committee to demand a 60-day public report back if the petition is referred to administration.

The district did not provide a direct public-family notice during the session; the petitioner said he had copied the superintendent and committee members on emails requesting notice and preservation of records. The committee acknowledged the petition and recorded it for follow-up; no formal investigative findings were presented at the meeting.