School officials in Williamson County are working to determine how sensitive data from as many as 17,000 students was accidentally released onto the internet.
The information was exposed in the fall of 2007 and included names, social security numbers, birthdates and test scores.
Williamson County school officials confirm that Christopher Nugent is responsible for the breach.
Nugent is a former principal at Crockett Elementary School and now works in the Williamson County Schools' main office where he is an assessment specialist who handles testing data and TCAP information.
Jason Golden, attorney for the Williamson County School System, told News 2 Nugent is authorized to have the sensitive data.
He said it was on a thumb drive, along with other information he inadvertently uploaded to a private Web site for an unrelated Williamson County school study.
Golden confirms Nugent spent Thursday at work, trying to recreate how the information was accidentally lost to the internet.
School officials said they were only notified of the breach earlier this week.
"According to state law, if information like this is released, it is incumbent upon the person who knows of the breach to report that to the school system or law enforcement," said Golden. "So far we cannot determine that any of that was done."
Golden said Nugent is being investigated for other serious violations including violating the Family Educational Rights and Privacy act.
On camera interview requests to school board members were denied.
Williamson County Director of Schools Dr. Becky Sharber did release a recorded message to all parents Wednesday night, letting them know what they know.
"The information we have from that employee indicates that test scores and social security numbers of our students then in grades three through eight were in those files, but we have not yet confirmed this," the message said.
"I apologize for this situation and we thank you."
Concerned parents should log onto SSNBreach.org and type in their child's name.
The Web site won't tell you what your child's social security number is, but it will tell you what type of sensitive information might have been compromised.