Personal information and bank account details for hundreds of teachers has been leaked in another Education Ministry Novopay blunder.

And no assurance has been offered that money was not stolen since the payroll system was first installed.

In the past month staff at Auckland's Marshall Laing Primary School were twice given access to unrecognised staff information through Novopay. The security breach could have allowed them to alter phone numbers, addresses and change bank account details for payments.

Last week it was revealed a teacher in Manawatu was able to have her pay details changed by a school where she used to work.

However, no one at her current school authorised the changes, which required sign-off by two payroll-authorised staff members.

Education Minister Hekia Parata would not comment on the security breach as Novopay responsibilities had been passed on to Associate Minister Craig Foss. He said every Novopay issue was taken seriously.

"As with all major projects, there will be a review looking into the implementation and development of Novopay," he said. "But there are no plans to implement another payroll system."

Marshall Laing Primary School associate principal Norma Ebsworth said theoretically it would be easy to divert money from a teacher's bank account through the breach.

"We were horrified to think if that is happening to another school and we're getting their rights, is someone getting rights to ours?" she said. "If someone got it who was not honourable, they could do something like that."

Foss said he had been advised it was "not possible" to confirm that funds had not been diverted.

Ebsworth said the school had been lucky that major payroll problems began only when a new office manager needed full access to the system.

"When our office manager finally got full admin rights she got admin rights to people from a different school, a school we think is a secondary school because it had 100-odd staff and we didn't recognise any staff," she said.

"Obviously we didn't go into an unknown school to see what we could do.

"The principal then contacted Novopay who took those admin rights away for that school and gave her admin rights for another school, again."

Although Novopay removed both unwanted administration rights within a day, the school's new office manager still doesn't have full administration rights to Marshall Laing staff.

Novopay business owner Rebecca Elvy said the system was rigorously tested to ensure it is a secure online service.

"We take the security of payroll data and employees' personal information very seriously," she said.

"We have escalated the issue at Marshall Laing Primary school to Talent2 to urgently investigate and resolve."

- © Fairfax NZ News

Comments