A school data breach leaves families with a strange mix of facts and blanks. You may get a notice, but not the one detail that matters most: what was exposed. If a cyberattack touched student or school records, start with the official pages and work from what they actually say.
Start with the official pages
The Federal Trade Commission has posted a consumer alert titled What to know after the Canvas cyberattack. The copy we could review did not include the alert's text. We cannot say which schools were affected or what data was involved. Open the page and read it yourself.
The FTC also publishes Data Breaches: What to Know, What to Do. By its title, it covers what to do when your information is exposed. For a child's records, the FTC has a second page, How To Protect Your Child From Identity Theft, and a PDF version. We could not review the steps inside either one, so this article does not summarize them.
The Department of Education's Parent's Guide for Understanding K-12 School Data Breaches was last updated in May 2021. It explains what a school data breach means and offers tools and best practices for protecting children's data afterward.
Work out who holds the rights
Under FERPA, parents have certain rights over their children's education records. When a student turns 18, or attends a postsecondary institution at any age, the student becomes an "eligible student." The rights then move from the parent to the student.
That shift changes who should be asking the school questions. A parent of a high school freshman can usually act. A parent of a 19-year-old college student usually cannot act alone on the record. The Department of Education guide points to a FERPA complaint path, but the pages we reviewed show only a link. They do not explain what a school must tell families after a breach or how a complaint is handled.
Know what a school holds and why it draws attackers
The Department of Education says education agencies, districts and schools are prime targets for cyberattacks because of the type and amount of personal data they hold. Its data breach topic page describes that data as including names, birth dates and contact details. Some systems also hold Social Security numbers. So a breach that sounds narrow, such as one tied to grades, can still matter.
Ransomware is one common attack type. It is malicious software that encrypts files and data on a device, so the owner cannot retrieve or use them. You do not need to diagnose the attack yourself. The word shows up often in breach reporting, and now you know what it means.
Ordinary habits can also open the door. The Department's Password Data Breach training scenario describes a teacher's login written on a sticky note and used to change grades. It also describes reused passwords that exposed systems holding Social Security numbers and other private employee information. The exercise is built for school staff, but it shows how one weak spot spreads.
Take the steps the FTC pages point to
The FTC breach publication and the child identity theft pages are the places to look for concrete steps. Read them in full before you act, and pick the child-focused page if the exposed record belongs to a minor. If the breach involves a student who is now an adult, the student should read them too.
These are the practical questions to answer, using those pages and your school's notice:
- What types of information were exposed, and for whom?
- Does the notice say whether monitoring or other services are offered?
- Who at the school or vendor is the named contact?
Our source material does not cover credit freezes, fraud alerts, how to request a credit report, or how to spot misuse of a child's identity. It also does not say when a school must send a breach notice. The FTC pages above are the right place to look for those details, so check them directly rather than trusting a summary, including this one.
Ask the school the right questions
The Department of Education also runs a recorded webinar, Data Breach Apocalypse, dated November 14, 2025. It runs about an hour and a quarter and covers managing breaches that start with third-party partners. Its audience is mainly school officials, vendors and researchers. It can still help a parent understand why a breach at a vendor becomes the school's problem.
When you contact the school, be specific. Ask which records were involved, which vendor or system was hit, and who you can reach with follow-up questions. Say whether you are writing as a parent or as an eligible student. That one detail decides who the school should answer.
The notice may be thin. That is common early on. Read the official pages, work out who holds the rights, and take your next steps from the FTC and Department of Education guidance.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
