Presumably the school district doesn't really care about its students' PII being released. I mean, they might feel a bit bad, and all else being equal they'd prefer not to have it released, but no one's going to lose their jobs or their funding just for that.
So the enforcement mechanism here has to be through the courts: some student or students will sue the district for negligence. Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job, so it's a good stick for the hackers to use if the district would lose such a lawsuit.
What's the case law like here? Are they likely to lose?
So the enforcement mechanism here has to be through the courts: some student or students will sue the district for negligence. Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job, so it's a good stick for the hackers to use if the district would lose such a lawsuit.
What's the case law like here? Are they likely to lose?