The San Diego Unified School District says a phishing attack exposed personal info of 500K+ students and staff, including full names, addresses, and SSNs
Student records from 2008 up to the present are impacted, district officials told NBC 7 — 500K Student Records Compromised in SDUSD Data Breach
Context & Ripple Effects
The San Diego Unified School District's disclosure that a phishing attack exposed full names, addresses, and SSNs for more than 500,000 students and staff — reaching back through records from 2008 — is an early entry in what has become a recurring pattern for US schools. The district joins institutions like UC Berkeley, which earlier notified 80,000 people after attackers reached its financial management software.
What makes the SDUSD breach notable in hindsight is the depth of the archive involved: a decade-plus of student records held in one place, the same structural weakness that resurfaced when districts hit by PowerSchool's December breach reported hackers accessed all historical student and teacher data across its 50M+ record base.
First-order effects
- Over 500,000 current and former students and staff face SSN-level identity theft risk, and the district must fund credit monitoring and notification across records spanning 2008 to the present.
Second-order effects
- Districts evaluating student-information vendors now have two cautionary data points — SDUSD's own archive exposure and the Raptor leak of evacuation plans and medical files used by 5,300+ districts — pushing procurement toward vendors who can prove retention limits and breach response.
Third-order effects
- SDUSD's phishing breach predates but foreshadows the shift documented by the three dozen ransomware attacks on districts educating 700,000+ students since March: school systems consolidating decades of sensitive records into centralized platforms become high-value targets, making long-retained student data a systemic liability rather than an administrative convenience.
The trend: US school districts are learning that centralized, long-horizon student data archives turn every vendor compromise into a decade-scale identity exposure, driving pressure for data minimization in education technology.