The scenario
The hardest 200 words you'll write all year. Families want to know what happened, what data, what to do, and who to call. The district that gets this wrong on day one spends the next six months apologizing.
First 60 minutes
- Acknowledge before you have answers. Silence reads as cover-up.
- Lead with what families should do next, not with what the district is doing.
- Name the playbook in plain language ('ransomware affecting school IT systems') — not vendor brand names.
- Promise a follow-up time you can keep. If you say 'by 6pm today,' send something by 6pm today even if it's only an update.
- Translate. Send the notice in every language your district translates routine communications into.
Decisions to make
Severity tier
- — Tier 1: SIS or one system down for the school day — operational notice, no PII language.
- — Tier 2: Vendor breach with student PII — formal notice, state-law timeline, free credit monitoring for adults if SSNs were in scope.
- — Tier 3: Ransomware affecting school operations — operational + PII notice, daily updates until restoration.
- — Tier 4: Sextortion or intimate-image incident involving a student — see dedicated playbook; mandatory-reporting overlay.
Who to call
- State or provincial breach-notification regulator (timeline-bound)
- Department of education if state-reporting data is in scope
- FERPA — district maintains record of disclosure
FAQ
Do we send the notice through the SIS parent-communication tool?
Only if the SIS is verified clean. Otherwise use a known-good channel: school website banner, district email from a non-compromised tenant, robocall, or paper sent home with students.
How fast must we notify families under FERPA?
FERPA itself does not impose a fixed clock, but most state student-data-privacy laws do. New York Ed Law 2-d, Texas HB 18, Illinois SOPPA, and Connecticut PA 16-189 all set specific timelines — see the regulations grid.