New revelations showing DOE’s continuing lack of concern for the privacy and safety of NYC students – please sign our letter to the Chancellor today!

May 16, 2025

1.Please read and sign our letter, already signed by several members of the Chancellor’s Data Privacy Working Group as well as advocacy organizations and NYC Council Members, in opposition to the weakening of DOE’s student privacy protections in their proposed amendments to Chancellor’s regulation A-820. If you would like to sign on, please fill out this form.

These revisions would allow DOE to disclose a vast array of highly sensitive student data to any individual or business they please, including students’ and parents’ names, email addresses, cell phones, home addresses, photos, and more, as long as they believe it would benefit the DOE or the students involved, with only a highly unreliable parent opt out method to prevent this. The weakening of this regulation is up for a vote at the at the May 28 vote of the Panel on Educational Policy, after the initial vote on this measure was delayed in October because of parent and advocate concerns and over 3,000 emails sent to the Chancellor and PEP members.

2. Evidence of the irresponsible practices of the DOE when it comes to protecting student privacy is further revealed by recent developments in the PowerSchool breach.

According to a May 7 announcement on the PowerSchool website and and numerous news accounts, extortionists have now contacted schools and districts affected by the original PowerSchool breach that occurred in December, threatening the further exposure of student data unless they are paid a ransom.

The original breach exposed the personal information of an estimated 60 million children, parents, and school staff across the US and in Canada, including an indeterminate number of current and former NYC students and teachers at four NYC high schools: Fordham HS for the Arts, Westchester Square Academy, Long Island City High School, and Lower East Side Prep.

It is unknown at this time whether any of these NYC schools have been directly contacted by the cyber criminals, as has occurred in the case of schools elsewhere, and DOE has still not posted anything about this new threat on its webpage entitled Data Security Incidents, where it is supposed to provide this sort of information.

Still to this day, DOE officials refuse to publicize the names of the four schools that had their student data stolen back in December, or to reveal publicly that former students at these schools likely had their information breached as well.

The DOE was also months late in informing parents at these schools that their children’s data had been breached, and even now, refuses to provide any guidance to the many NYC schools that they should stop using the 16 other invasive PowerSchool programs that collect a wide range of personal student and teacher data, even though it’s been shown that the company did not employ even the most basic security measures to prevent hacking. PowerSchool is now being sued by more than 20 different states, districts, and class action lawsuits as a result.  

The DOE’s lackadaisical attitude towards protecting student data is especially relevant right now, as mentioned above, as proposals to weaken their Chancellor’s regulation, A-820 are on the agenda to be voted on by the PEP at the end of the month.

The only significant concession DOE has made in the latest round of revisions to this regulation is to require a written agreement with the third parties with whom they want to share all this sensitive student data , but as we have seen in the PowerSchool breach, as well as many others, including the Illuminate breach that exposed the data of more than a million NYC current and former students, their written agreements have done little to stop the illegal disclosures and commercial exploitation of student data because of insufficient oversight and enforcement.

More details on the earlier PowerSchool breach and the recent ransomware attacks are below.

Background

The original hack of the PowerSchool School Information Systems (SIS) began on December 19 and ended on December 28. On January 6, PowerSchool informed hundreds of districts and schools systems nationwide and in Canada that personal data stored in their student information systems had been accessed; later they admitted that they paid ransom to the criminals in exchange for their promise to destroy the data.

Many districts throughout New York state and elsewhere alerted parents to the threat, in early to mid-January, and shortly thereafter advised them how to sign up for free identity theft insurance and credit monitoring offered by PowerSchool. It is well known that student data is very valuable for purposes of identity theft, as most children do not already have a credit rating.  

Yet DOE said nothing to parents about this at the four affected schools, and in fact, when reporters asked in January if any NYC schools were affected, DOE told them no.

It was not until February 3 that I learned in an email from the NY State Education Department Chief Privacy Officer Louise de Candia that four NYC schools did indeed have their student data hacked, and she gave me the schools’ names. I forwarded this information to the Daily News reporter, Cayla Bamberger, who wrote an article about the breach on February 6 (free link here). I also posted more details about the breach on my blog.

But amazingly, even then the DOE refused to confirm the names of the affected schools to reporters, or to post their names on their website, even though the State Education Department specifically advised districts to do so, to alert former students to the risk to their privacy and safety. They wrote:

Like the Illuminate Education data breach that occurred in late 2021/early 2022, former students may be affected by this breach. Therefore, we recommend that educational agencies put a notification on their web page to capture as wide an audience as possible.

Further delay and inadequate notification of affected families and students

Only following the Daily News article did principals send a message to parents at these four schools, saying that they were still looking into whether their children’s data had been breached.

Not until March 7, more than two months after the initial reports, did DOE apparently confirm internally that NYC students, former students, and staff had their data stolen by hackers, even though back in January there were relatively simple instructions on Reddit and elsewhere on how schools and districts could check their SIS log files to confirm which students and teachers were affected, and what data had been stolen.  

It was not until three weeks after that, the week of April 1, that the DOE mailed notification letters to affected students and staff, and not until April 3 was the following message posted on the DOE website:

“Approximately 3,437 students and 317 staff were affected by the PowerSchool SIS data security incident. … All students who were affected by this incident had the following information disclosed: name, student ID number, date of birth, grade level, expected graduation year, enrollment information, and home address. Some students also had race/ethnicity, gender, classroom assignment, parent name, parent email, home phone number, emergency contact name and phone, and medical contact information disclosed.  All staff who were affected by this incident had their file number/employee ID disclosed.”  

Still this statement was far from complete, as the DOE continued to refuse to disclose the names of the affected schools on the website, or that former students also had their data breached. This was confirmed to me by the DOE chief privacy officer Dennis Doyle after I asked him about it. Though he said he didn’t know how many former students were affected, “it’s possible the impacted data goes as far back as the 2021-22 school year.” By looking at the demographic snapshot just for Long Island City HS, that means that another 1,321 students who were enrolled that year but have since graduated or dropped out may also have their data hacked.

The NY Ed Law 2D regulations pertaining to student privacy require that parents be informed as soon as possible about a breach of personal student data and in no case, more than 60 calendar days after its discovery:

“Educational agencies shall notify affected parents, eligible students, teachers and/or principals in the most expedient way possible and without unreasonable delay, but no more than 60 calendar days after the discovery of a breach.”

Of course, 60 days is too long in any case; State Ed originally proposed 45 days in their regulations, but some districts apparently complained this was too short a time frame.. NY state has now amended its general business law to require all businesses to notify affected individuals of breaches within 30 days, though it’s not clear if schools and district apply.

In any case, given that districts were informed of the PowerSchool breach on January 7, that would make the deadline in state law for notification March 8, 2025 – and yet parents in NYC were not sent letters confirming their kids’ data was breached until three weeks later.

Unfortunately, the DOE has said nothing publicly about these recent ransomware attacks, though there is an update on their website dated May 8, the day after PowerSchool and numerous media accounts, including NBC news, reported on these new threats to student privacy. Instead, the DOE only informed parents on that date that the deadline to sign up for PowerSchool’s offer of free identity theft insurance had been extended to July 31, while adding, “There is no evidence of continued unauthorized access”, even as parents throughout the country were being warned otherwise.

For example, schools in North Carolina received extortion emails on May 7, according to the state Department of Education’s public bulletin, posted the same day, alerting the public that these criminals appeared to have students’ and staffers’ names, contact information, birthdays, medical information, parental information, and in some cases even their Social Security numbers.

The North Carolina State Superintendent produced a template that districts were asked to send to parents, warning them not to respond if contacted by these threat actors, and not to open any suspicious links or emails related to this incident, or engage with anyone claiming to have this data.”

About the more recent ransomware threats, there are three possible scenarios according to the analysis in this article: that the original hackers did not delete the data back in January as they promised PowerSchool after receiving payment; or they had already sold or released the data to another group before deleting it. There is a third possibility: that these latest demands are empty threats, but as PowerSchool reported, the samples of personal data sent to schools as warnings in May match the data previously stolen in December.

DOE’s continued lack of oversight, transparency and enforcement when it comes to student privacy

All this sadly might have been prevented if DOE had taken the necessary precautions. The privacy addendum that PowerSchool provided to DOE several years ago, and still posted on the DOE website should have provided sufficient warning. It said that the company will:

“Review data security and privacy policy and practices to ensure they are in conformance with all applicable federal, state, and local laws & the terms of this DSPP [Data Security Privacy Plan].… In the event Processor’s policy and practices are not in conformance, Processor will implement commercially reasonable efforts to ensure such compliance.”

In other words, PowerSchool proclaimed that they would comply with federal and state privacy laws — and their own contract with DOE – only if they felt it was “commercially reasonable” and would not unduly affect their bottom line.

I also pointed out that DOE allows schools to use 17 privacy-invasive PowerSchool programs that collect a huge amount of sensitive teacher and student data, and asked for a meeting to discuss the many other ways in which the DOE consistently fails to properly vet their privacy agreements or to follow up with their vendors to ensure they are adhering to these agreements. Here is a copy of one of the slides I sent him.

In any case, I never got the meeting with Dennis I had requested nor did I receive any response to my warnings about PowerSchool.