Tabletop Exercise: A Student Data Breach at a School District

Reference article · 5 min read

A tabletop exercise is most useful when it rehearses the situation a district is least ready for. For many districts that is not ransomware on district-owned servers. It is an email from a vendor saying that student records held on the vendor's platform were exposed. The district learns about it secondhand, incompletely, and after the fact. The obligation to families and to the state still sits with the district, while the logs, the forensic timeline, and the pace of disclosure sit with a company the district does not control.

The scenario below runs in about ninety minutes with a facilitator and a group that does not normally sit at the same table. It stays vague about scope on purpose, because the hardest decisions get made before scope is known. Change the names, systems, and grade bands to fit your district, and put your actual vendor contract on the table before you start.

Who should be in the room

Beyond IT and security, seat these roles:

• Superintendent or a designated decision maker. Someone who can authorize notification and a public statement without another meeting.
• Communications or public information. Owns the family message, the staff message, and the reporter.
• Legal counsel. Including whoever decides whether the investigation is directed under privilege.
• Student information system owner and registrar. They know which fields actually live in the vendor platform, and which students are in it.
• Special education and multilingual services leads. Records tied to disability status, services, or English learner status carry added sensitivity and sometimes separate rules.
• Procurement or contract administration. The only person who can say what the data protection addendum requires.
• Risk management. Cyber policies often carry prompt notice conditions.
• Board liaison and a building principal. The board hears from constituents, and principals absorb front office calls.

Note who is absent: the vendor. Have the facilitator play that role, answering slowly and partially.

The scenario

Your district uses a third-party assessment and progress monitoring platform under a central contract. On a Thursday afternoon, the vendor's account manager emails an assistant superintendent. The vendor identified unauthorized access to a reporting environment, and a subset of district records may have been involved. The email does not say which students, which fields, or when, and it asks the district to hold the information confidential while the investigation continues. Start the clock there.

Injects

1. Twenty minutes in. A middle school registrar reports that parents called saying they received email from a stranger referencing their child's reading scores. Nothing confirms the calls are related.
2. Forty minutes in. The vendor answers partially: the environment held rosters for grades three through eight, and fields may include name, student identifier, date of birth, school, and assessment results. It cannot confirm whether a special education services flag was in the same export.
3. Sixty minutes in. A local reporter emails asking for comment on a breach affecting district students, citing an unnamed source, on an end-of-day deadline.
4. Seventy-five minutes in. A board member forwards a parent email and asks whether families will be notified tonight.
5. Optional. The vendor's counsel sends a draft joint statement and asks the district to approve language saying there is no evidence of misuse.

The decisions to force

• Notification timing. States generally impose breach notification duties on entities holding personal information, and many also have student data statutes reaching school service providers and districts. Deadlines, covered data definitions, and required recipients vary, so confirm your state's current rules with counsel. In the exercise, settle what starts your clock: the vendor's first email, or written confirmation of specific records.
• FERPA. FERPA governs disclosure of education records and does not by itself set a breach notification deadline. A vendor operating under the school official exception acts on the district's behalf, so an unauthorized disclosure by the vendor is the district's problem, not only the vendor's. The U.S. Department of Education's student privacy office publishes guidance on breaches involving education records; treat it and state law as separate and cumulative.
• Who speaks. Decide whether the superintendent, a communications officer, or principals address families, and whether the district comments on the record before it can describe scope. Draft a holding statement in the room, and decide what front office staff may say before the official message lands.
• Board notification. Settle whether a briefing goes to the full board or the president first, how it fits your open meetings rules, and who answers the member who already emailed.

What you can compel from the vendor

This is where exercises stall, and where the value is. Read the contract aloud and look for:

• Notice to the district within a defined period after the vendor becomes aware, not after it closes an investigation.
• A right to the forensic report, or at least a written scope statement listing affected records and fields.
• Cooperation with district notification, including who pays for notices and monitoring services.
• District approval of any public statement that names the district.
• A current data inventory, so the district can establish what the vendor holds without waiting.
• Audit rights, deletion obligations at termination, and subcontractor disclosure.

If those terms are missing, that is the exercise output. Carry it into the next renewal and your standard data protection addendum.

Closing out

Reserve the last fifteen minutes for a hot wash. Capture three things: decisions nobody in the room had authority to make, facts nobody owned the source for, and contract language that failed the test. Assign owners and due dates before anyone leaves, then rerun the scenario with a different grade band and a different vendor.

HQT works with state and local agencies on cybersecurity planning, incident response preparation, and the controls around third-party handling of sensitive data.

Frequently asked questions