Edtech cybersecurity risks
The edtech sector has been increasingly targeted by cybercriminals: (1) Edtech platforms store valuable data (student names, DOBs, performance, parents' emails), (2) Edtech often has weaker security than finance or healthcare, (3) Schools have limited IT security budgets and staff, (4) The rapid shift to online learning during and after COVID expanded the attack surface, (5) Many edtech platforms are third-party services used by schools, making them an attractive target. Recent edtech breaches include: Mathspace (1M+, 2026), PowerSchool (3.5M students, 2024), Illuminate Education (1M+ students, 2021), and Schoology (millions of users, 2020) (Cybersecurity Dive, 2026).
What Mathspace is doing in response
Mathspace has: (1) Activated incident response protocols, (2) Engaged leading cybersecurity firms, (3) Notified the relevant authorities (US Department of Education, Australian Cyber Security Centre, etc.), (4) Notified affected schools, teachers, and parents, (5) Offered free credit monitoring and identity theft protection for affected individuals, (6) Implemented additional security controls to prevent similar breaches, (7) Coordinated with law enforcement (Mathspace, 2026).
What parents and teachers should do
- Monitor for phishing emails referencing Mathspace or student data.
- Check for new accounts opened in the student's name.
- Review the credit reports of minors (where available — free in some states).
- Consider placing a credit freeze for minors in the US (free, prevents new account opening).
- Contact Mathspace for the latest updates and remediation at [email protected].
- File a complaint with the FTC at identitytheft.gov if identity theft is detected.
- Contact the school's IT department to confirm the breach and understand the school's response.
- Encourage your child to report any suspicious online activity.
What schools should do
- Communicate with parents about the breach and remediation steps.
- Review the school's data processing agreement with Mathspace.
- Consider migrating to alternative edtech platforms with stronger security.
- Implement additional security training for staff and students.
- Report the breach to the relevant education authorities (e.g., US Department of Education).
- Provide free credit monitoring to affected students where appropriate.
- Conduct a security audit of all third-party edtech platforms.
Edtech security best practices
- For edtech vendors: Implement strong authentication (MFA), encrypt data at rest and in transit, conduct regular security audits, comply with student privacy laws (FERPA, COPPA, GDPR-K), publish security policies, and notify schools promptly of breaches.
- For schools: Vet edtech vendors before adoption, review data processing agreements, limit data shared with vendors, monitor for breaches, and have a data breach response plan.
- For parents: Understand what data schools share with edtech vendors, opt out of data sharing where possible, monitor children's online activity, and report suspicious activity to the school and FTC.
Education data privacy laws
- FERPA (US): Family Educational Rights and Privacy Act — protects student education records, requires parental consent for data sharing.
- COPPA (US): Children's Online Privacy Protection Act — protects children under 13, requires parental consent for data collection.
- State student privacy laws (US): California SOPIPA, Illinois SOPPA, and others provide additional protections.
- Privacy Act 1988 (Australia): Federal law protecting personal information of Australian citizens.
- GDPR (EU): General Data Protection Regulation — protects personal data of EU citizens, applies to edtech companies serving EU students.
- UK GDPR / DPA 2018: UK equivalent of GDPR.
Resources and next steps
Visit identitytheft.gov for free identity theft recovery resources. The US Department of Education's Student Privacy Policy Office (SPPO) provides resources at studentprivacy.ed.gov. The Identity Theft Resource Center (idtheftcenter.org) provides free victim assistance. For edtech security best practices, see the Future of Privacy Forum (FPPF) and the Student Data Privacy Consortium (SDPC). For Australian privacy resources, see the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Fazlur Rahman
