Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteA U.S. school should activate its incident-response and communications plans, preserve evidence, assess what systems and information may be involved, and report the intrusion through appropriate government channels. Whether and when it must notify families is a separate question: FERPA does not itself require notice that education-record information was stolen or released without authorization, but state law and the incident’s facts may create notice duties.
What should a school do first after a cyberattack?
Start the response while facts are still developing. A cyberattack does not by itself prove that student records were accessed or disclosed, so the school should avoid making claims about affected data before it has evidence.
As an Amazon Associate I earn from qualifying purchases.
- Activate the response and communications plans. Bring in the appropriate IT or security staff, school leadership, managed service providers, insurer, and other relevant responders. CISA recommends an incident-response plan and an associated communications plan with response and notification procedures, regular leadership updates, and coordination with communications staff. See the CISA, FBI, and NSA #StopRansomware Guide (September 2023).
- Preserve evidence and contain the incident with qualified help. CISA advises collecting relevant logs and malware or indicators, and capturing system images and memory where appropriate. Some evidence is volatile and can be lost; responders should decide how to preserve it while containing the incident. Coordinate with law enforcement when appropriate.
- Establish what is known—and what is not. Identify affected systems and records, the categories of personal information involved, whose information may be affected, and whether there is evidence of access, acquisition, or disclosure to an unauthorized party. The Department of Education explains that an unauthorized disclosure of personally identifiable information from education records can raise FERPA concerns; the incident facts matter. See its guidance on unauthorized disclosure.
- Keep an accurate record of decisions and updates. Share confirmed facts with leadership and communications staff as the investigation progresses. Separate confirmed information from open questions in any public statement.
Where should a school report a cyberattack?
Reporting an intrusion to authorities is distinct from notifying affected families. CISA’s K–12 cybersecurity report urges schools to report every cyber intrusion to the U.S. government. Its Protecting Our Future report identifies CISA and FBI reporting channels; the CISA ransomware guide also lists the U.S. Secret Service as an option.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Contact | How it fits |
|---|---|
| CISA | Report through CISA’s cyber incident reporting channel and consider requesting assistance. CISA is identified as a reporting and assistance option in the #StopRansomware Guide; the K–12 report says any organization can report through CISA’s Report to CISA webpage. |
| FBI | Contact a local FBI field office or submit a report to the FBI’s Internet Crime Complaint Center (IC3), both identified in CISA’s guide. |
| U.S. Secret Service | A local field office is another reporting or assistance option listed in CISA’s guide. |
| MS-ISAC | CISA’s K–12 report describes membership and 24/7 support for eligible public K–12 entities. Confirm eligibility and current services directly. |
Use the school’s incident plan to decide who makes each report and what information can be shared. Report known facts rather than waiting for every question to be resolved, and update authorities as the investigation develops. CISA’s recommendation is to report every cyber intrusion; that recommendation is not the same thing as a family-notification deadline.
Does a school have to tell parents about a data breach?
FERPA does not itself require a school to notify a parent that information from the child’s education records was stolen or otherwise released without authorization. The Department of Education states this in its K–12 parent guide to school data breaches (last updated May 2021). FERPA’s lack of a specific parent-notice requirement does not establish that no notice is due.
The school must separately consider the breach-notification law that applies in its state or territory, along with relevant local policies, contracts, insurance conditions, and other applicable obligations. CISA advises organizations to ensure their breach-notification procedures adhere to applicable state law in its #StopRansomware Guide. The sources cited here do not establish one deadline or recipient list for every U.S. school. The applicable jurisdiction and the information involved must be identified before stating who must be notified or by when; the school should obtain jurisdiction-specific legal advice.
Rank #2
What should a family notice say?
When notice is required or appropriate, it should give families useful, evidence-based information rather than speculate about the incident. CISA recommends describing the type of information exposed, suggesting practical steps people can take to reduce misuse, and providing relevant contact information in its #StopRansomware Guide.
Recommended Free Tools
- Describe the incident and the information involved. State what the school has confirmed about the type of information and affected systems. If the investigation has not established whether information was accessed or disclosed, say that clearly.
- Explain who may be affected. Identify the group or records involved to the extent the school can do so accurately, and avoid implying that every student or family is affected if that is not known.
- Give practical next steps grounded in the incident facts. Tell recipients what they can do to reduce the risk of misuse, where applicable.
- Provide a way to get help and an update. Include relevant contact information and say when or how the school expects to share further information, if known.
- Meet the applicable legal requirements. The required recipients, content, and timing depend on the law that applies to the school and the data involved.
How soon must families be notified?
There is no universal U.S. school deadline established by the federal guidance cited here. FERPA itself does not set a parent-notification requirement for stolen or otherwise improperly released education-record information, while state or territorial breach laws may impose separate requirements. A school should check the rules for its jurisdiction and the incident’s facts before announcing a deadline or delaying a notice it is legally required to send.
Rank #3
What should parents do if they are concerned?
Ask the school what information may be involved, whether the school has confirmed access or disclosure, what steps families should take, and how it will provide updates. If the school has sent a notice, follow the specific precautions it recommends and use the contact details it provides for questions. The school’s confirmed findings—not the mere fact that a cyberattack occurred—determine what can be said about a child’s records.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
