Permanent Record: How School Data Breaches Put Your Child's Identity on the Market

Your child may have had their Social Security number stolen before they were old enough to open a bank account. They had a home address, a date of birth, a medical file, and in a lot of cases, a documented disability sitting in a criminal's database before they finished middle school. And here's the part that should stop you cold. Nobody at the school was careless or malicious. The system worked exactly the way it was built to work. In December of 2024, someone logged into PowerSchool, the student information system that runs a huge share of American public schools, using a single stolen password. No zero day, no sophisticated intrusion, just a valid login. By the time it was over, the records of roughly 62 million students and 9.5 million teachers were gone across more than 6,500 school districts in the United States and Canada. The person who did it was a 19-year-old college student named Matthew Lane. In October 25, a federal judge sentenced him to four years in prison and ordered him to pay about $14 million in restitution. PowerSchool paid a ransom to keep the breach quiet, and the data got used against the schools to extort individual districts anyways. Your child didn't sign up for this. They did not read or sign a terms of service. You didn't get to pick the vendor. The school made that choice. The vendor got breached, and the most sensitive file that will ever exist about your child is now permanent in a way that no school ever meant when they used the phrase "permanent record". Today, we are talking about the state of cyber threats aimed at public schools and how your child's data and identity is vulnerable, and what you can actually do when the institution holding your family's data cannot protect it. I am Alan Pace, and this is the OppSet Podcast. Let's start with a simple question. If you were a criminal ransomware gang looking for the highest payoff against the weakest defense, where would you go? You would go somewhere that holds enormous amounts of sensitive personal data, has almost no security budget, runs old systems or aging systems that it can't afford to replace or update, employs no dedicated cybersecurity staff, and operates under enough public pressure that shutting it down forces a fast reaction. That is a description of the average American school district. CISA has put a number on how routine this has become. For K-12 schools, cyber incidents are so frequent now that on average there is more than one per school day. Education is not collateral damage in the ransomware economy. It is a primary target, and the reason is structural. A district has to keep decades of records on every student who passes through there. It runs a student information system, a learning management system, special education software, transportation monitoring software, food service software, and dozens of third-party apps that teachers and other staff sign up for on their own. Every one of those is a door. Most districts could not tell you how many doors they even have, let alone which ones are locked. And the things behind these doors that needs to be protected isn't a credit card that gets canceled and reissued if it gets stolen. It is a