Ed Tech Co. That Provides Telehealth to L.A. Students Experiences Data Breach

Get stories like this delivered straight to your inbox. Sign up for The 74 Newsletter

An education technology company that built an app for Los Angeles students to receive telehealth services during the school day has fallen victim to a data breach that puts students’ sensitive information in jeopardy, a disclosure to state regulators reveals. 

The company, Kokomo Solutions, also hosts an anonymous tip line where Los Angeles community members can report suspicious activity, safety threats and mental health crises to the school district’s police department. In an Aug. 5 data breach notice filed with the California attorney general’s office, the company disclosed that an unspecified number of individuals’ personal information was compromised after an “unauthorized third party” accessed its computer network and the exposed files pertained to the Los Angeles Unified School District. 

The company, also known as Kokomo24/7, says it discovered the unauthorized access on Dec. 11, 2024, nearly eight months before it disclosed what happened to victims. The district has not issued any public statements alerting students and families that their sensitive information may have been compromised. 

While many details about the breach remain unknown, including the specific types of information that were compromised and whether the breach was the result of a cyberattack, the incident raises red flags because “there’s no question that [Kokomo is] managing exceptionally sensitive information” about campus safety issues and students’ medical information, school cybersecurity expert Doug Levin said. 

“This is another example of schools outsourcing the collection and management of exceptionally sensitive data on school communities which, if abused, could affect the health and safety of the school community,” said Levin, the co-founder and national director of the K12 Security Information eXchange. “We definitely would benefit from knowing more about how they were compromised and how they’re going to fix it.”

The district didn’t respond to requests for comment. Neither did Kokomo24/7, which has apparently scrubbed its website over the last few days of references to its work with the nation’s second-largest district. 

Launched in 2023, the Los Angeles Schools Anonymous Reporting app allows students, parents and others in the community to report “suspicious activity, mental health incidents, drug consumption, drug trafficking, vandalism and safety issues” to the district’s 268-member police department. 

That same year, L.A. schools contracted with Kokomo — along with the Children’s Hospital Los Angeles and Hazel Health — to launch new district telehealth services. The $800,000 program, funded by federal pandemic relief money, is designed to provide app-based mental and physical health care to students, including at school. Hazel Health provides virtual mental health services, according to the district’s website, while Kokomo24/7’s services focus on physical health issues, including minor injuries, allergies and headaches. 

In a letter to parents last updated in July, the district describes its Kokomo24/7-managed telehealth program as an option for students “to access healthcare when not feeling well during school hours” with the supervision of a school nurse “while remaining in school and focusing on learning.” 

Kokomo founder and CEO Daniel Lee wrote a blog post last year lauding the company’s ability to “transform” L.A. Unified’s COVID-tracking and health data system in a year after the school system’s previous tool became “clunky, difficult to customize and expensive to maintain.” The post notes the company’s role in creating the anonymous reporting application and the district’s Incident System Tracking Accountability Report, an internal tool to document injuries, medical emergencies and campus threats.

The Kokomo24/7 breach is the latest in a series of data privacy incidents affecting L.A. schools, including a high-profile ransomware attack in 2022 that led to the exposure of thousands of students’ mental health records. Schools Superintendent Alberto Carvalho at first categorically denied that students’ psychological evaluations had been exposed but then had to acknowledge that they were after The 74’s investigation revealed the records’ existence on the dark web.

Meanwhile, the district’s rollout last year of a highly touted AI chatbot named “Ed” was derailed after AllHere, the ed tech company hired to develop the $6 million project, shuttered abruptly and filed for Chapter 7 bankruptcy. The company’s founder and CEO, Joanna Smith-Griffin, was then indicted on charges she defrauded investors of some $10 million. A company whistleblower told The 74 AllHere’s student data security practices violated both industry standards and the district’s own policies. 

The L.A. district considered three companies for the chatbot bid — including Kokomo24/7 — before awarding the contract to AllHere. Both the bankruptcy and criminal cases are pending. In July, a school district spokesperson told The 74 that Ed “remains on hold.” 

The Kokomo24/7 website lists a wide suite of products, primarily in physical security including building access control systems, emergency alarms and visitor management tools. It also names large companies among its customers, including The Oscars — the company was the “health and safety software provider” for the 2022 Academy Awards — United Airlines’ subsidiary United Express and Fifth Third Bank. 

But the Illinois-based company has a relatively small footprint in the education sector, according to records in the GovSpend government procurement database. Among the handful of its school district clients is the Hartford, Connecticut, school system where educators spent more than $60,000 between 2020 and 2023 for licenses to the company’s Covid-19 Tracker to screen students’ temperatures, track infections and conduct contact tracing. Glendale Unified, a neighboring district to Los Angeles, is also listed as a client on the company’s website.

Kokomo24/7’s connections to the L.A. district were widely featured on the company’s website until this week. In fact, a timeline about the company’s 2018 founding listed four foundational events, including the 2023 launch of the “anonymous reporting app for students and an emergency alert system for staff” for the L.A. district.

The reference to the school district was removed from the company timeline this week, as was a banner attributing a quote to Carvalho, a picture of district police officers and the district police department’s logo. Press releases announcing Kokomo’s work with the L.A. district appear to have also been scrubbed from the internet. 

The since-removed Carvalho quote called the district rollout of its anonymous reporting app “critically important.” Though slightly misstated, the remark comes from a March 2023 school board meeting where Carvalho boasted of people’s ability to “relay in an anonymous way — or not — potential threats” to a student or a school. 

The Los Angeles Schools Anonymous Reporting app hasn’t been universally praised, and last year became the subject of litigation filed by anti-surveillance activists who alleged the tool created “a culture of mass suspicion” and bolstered police interactions between students of color and those with disabilities. 

The Stop LAPD Spying Coalition, which filed the lawsuit seeking records about the app, claimed it enabled students, parents and community members “to surveil each other” on behalf of school police and to file reports that don’t require evidence. It also questioned why the community was being encouraged to file reports on people in mental health crises as part of a broader effort to investigate “suspicious activity.” 

“The app criminalizes mental health, perpetuating the idea that if someone has a mental illness they are inherently a threat to others,” the activist group wrote in a September 2023 report.

Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter