Children's data breached in admissions site vulnerability - AI News Today Recency

# Children's Data Breached in Admissions Site Vulnerability

A student admissions website used by families to enroll children into schools has exposed sensitive personal information through a significant security lapse[3]. The vulnerability, which has since been fixed, highlights growing concerns about how educational technology platforms protect children's data in an increasingly regulated environment.

What Happened in the Admissions Site Breach

The security flaw allowed unauthorized access to children's personal information stored on the admissions platform[3]. This incident comes amid a broader pattern of data breaches affecting educational institutions and student information systems. The vulnerability represents a critical failure in security protocols designed to protect one of the most sensitive categories of personal data: information belonging to minors.

Educational technology platforms handling student enrollment data face particular scrutiny because they collect comprehensive personal details including names, contact information, dates of birth, and sometimes medical or special needs information. The exposure of such data through a public-facing admissions website demonstrates how easily attackers can exploit configuration errors or unpatched vulnerabilities to access protected information at scale.

Rising Regulatory Pressure on Children's Data Protection

Federal regulators have made children's privacy protection a top enforcement priority, with the Federal Trade Commission (FTC) implementing significant new requirements under the amended Children's Online Privacy Protection Act (COPPA)[6]. The updated rules, which take effect in April, mandate that operators collecting data from children under 13 establish written information security programs and data retention policies[4].

The FTC's enforcement actions reflect this heightened focus. Recent settlements include a $20 million penalty against Cognosphere for collecting personal information from children in violation of COPPA through its video game Genshin Impact, and a $500,000 penalty against robot toy maker Apitor for collecting geolocation data without parental consent[5]. These actions signal that regulators intend to enforce children's privacy requirements aggressively across all sectors, including education technology.

Beyond federal regulations, states have begun implementing their own protections. New York's Child Data Protection Act restricts data collection from minors, limits certain design features deemed harmful, and prohibits targeted advertising to minors[6]. Similar age-gating and parental consent regimes have been adopted in Utah, Arkansas, and Louisiana[6].

Learning from Major Education Sector Breaches

The admissions site vulnerability adds to a troubling pattern of breaches in the education sector. One of the largest education-sector data breaches ever investigated in Canada involved PowerSchool, a student information system widely used by Canadian school boards[1]. In late 2024, threat actors gained access using compromised credentials from a support contractor, exfiltrating sensitive data affecting millions of individuals across multiple provinces[1].

The PowerSchool investigation revealed that compromised data included names, dates of birth, contact details, student ID numbers, medical alert fields, accommodations, and guardianship indicators[1]. Similarly, the Illuminate Education breach exposed personal information of millions of students across multiple states, including over 434,000 California students and 1.7 million New York students[5]. That breach occurred when a hacker accessed Illuminate's network using credentials from a former employee whose access had not been removed[5].

Regulators investigating these breaches found that school boards remained legally responsible for protecting personal information even when third-party vendors operated the systems[1]. The investigations highlighted failures in cybersecurity safeguards, contract management, data retention practices, and breach preparedness[1].

What Organizations Must Do to Comply

Educational technology providers and school districts must now implement comprehensive security measures to meet evolving regulatory requirements. Under the amended COPPA rules, operators must designate employees to coordinate information security programs, conduct risk assessments at least annually to identify risks to children's data, and design safeguards to control identified risks[4].

Organizations also face new requirements for obtaining verifiable parental consent. Approved methods include requiring parents to use a credit card for transaction alerts and using knowledge-based authentication with multiple-choice questions that would be difficult for children age 12 and younger to answer[4]. Additionally, companies must establish and publish written data retention policies specifying how long children's information will be kept[4].

The FTC has signaled that its enforcement priorities include protecting children's privacy, halting unfair collection and selling of sensitive data, and pursuing violations involving deficient security practices[5]. Compliance deadlines are approaching, with many organizations needing to prioritize updates to their data collection, retention, security, and disclosure practices by April 2026[4].

Frequently Asked Questions

What personal information is typically exposed in education sector breaches?

Education sector breaches commonly expose names, dates of birth, contact information, student ID numbers, Social Security numbers, medical alert information, and special accommodations or guardianship indicators[1][2]. The specific data varies depending on what information schools collect and store in their systems.

Who is legally responsible for protecting student data when a third-party vendor is breached?

School boards and educational institutions remain legally responsible for protecting personal information even when third-party vendors like PowerSchool or Illuminate Education operate the systems[1]. This means schools cannot shift all liability to vendors and must ensure adequate contract management and cybersecurity oversight.

What are the new COPPA requirements taking effect in 2026?

The amended COPPA rules require website and online service operators collecting data from children under 13 to establish written information security programs, conduct annual risk assessments, implement data safeguards, maintain written data retention policies, and obtain separate verifiable parental consent before sharing children's data with third parties[4][6].

How much have the FTC fined companies for children's privacy violations?

Recent FTC penalties include $20 million against Cognosphere for collecting children's data without consent through Genshin Impact, $5.1 million against Illuminate Education for false security claims and inadequate protections, and $500,000 against Apitor for collecting geolocation data without parental consent[5].

What should parents do if their child's information was exposed in an admissions site breach?

Parents should monitor their child's credit reports, enroll in available identity protection services if offered by the affected organization, watch for suspicious activity, and consider placing a fraud alert or credit freeze on their child's accounts[2]. Many breached organizations now offer free credit monitoring services like Experian IdentityWorks to affected families.

Are there state-level privacy laws protecting children's data beyond COPPA?

Yes, states including New York, Utah, Arkansas, and Louisiana have implemented their own privacy protections for minors[6]. New York's Child Data Protection Act restricts data collection, limits addictive design features, and prohibits targeted advertising to minors[6]. These state laws may face constitutional challenges but represent a clear regulatory trend toward heightened protections for children's data.