Lake County School District: employee error exposed unredacted education and disability records of ~47,000 students; district suing parent to destroy data
Severity: medium · Patch status: no-fix-needed · Since 2026-11-10
An employee of Lake County Schools (Florida) mistakenly sent a parent unredacted data covering confidential education and disability records of approximately 47,000 students. Rather than a malicious breach, this was an administrative error in fulfilling a records request. The Lake County School Board has filed a lawsuit seeking an injunction requiring the parent who received the unredacted records to destroy them, and is reportedly seeking to prevent further dissemination. Affected individuals are students whose special education and confidential records were included. No attacker or exploitation is indicated; remediation is legal and procedural (injunction, notification, staff process review) rather than a technical patch.
What to do
- Review and tighten redaction/QA procedures for records requests and bulk data exports
- Assess whether FERPA/state breach notification obligations to affected families are triggered
- Limit and log access to special education and disability records; apply least privilege
- Train staff on handling confidential student records and require dual review before disclosure
- Monitor for any further dissemination of the exposed records
Sources
All live incidents on Threat Watch
