The Cybersecurity Gap Florida Left Wide Open for Schools
In 2018, an unsecured server exposed the records of about 50,000 Leon County students, parents, and teachers. Florida Virtual School later confirmed the breach reached roughly 368,000 records statewide. Most parents in Tallahassee never heard about it.
That breach happened eight years ago. The law still has not caught up.
Florida requires state agencies and every county and city to run a real cybersecurity program. Florida never extended that requirement to schools, public or private. The law protecting your city hall does not protect your child's classroom.
The numbers back this up. In an 18-month study covering 2023 and 2024, the Center for Internet Security found 82 percent of K-12 schools faced a cyber incident. In 2021, Broward County Public Schools faced a ransomware demand of 40 million dollars. In May 2026, hackers breached Canvas, the learning platform used in thousands of schools, exposing data tied to a reported 275 million users across K-12 and university systems. Each school followed privacy rules. None ran a state-required cybersecurity program.
Florida Statute 282.318 sets cybersecurity standards for state agencies. Florida Statute 282.3185 extends those standards to counties and municipalities. Neither statute names school districts or private schools. The state built a security standard for its own offices and never extended it to the classroom where your child spends the day.
That gap is about to widen, not close. Schools add AI tools every year, from tutoring chatbots to grading assistants to enrollment software. Each new tool adds another vendor with access to student data. Vendor-related incidents made up 4 percent of all K-12 breaches in 2023. By 2025, vendors caused 32 percent of them, according to Clever's 2026 Cybersecure report. The same report found that 52 percent of U.S. school districts experienced a cybersecurity incident in 2025, up from 36 percent in 2024 and 31 percent in 2023. The trend line only moves one direction.
The state has no security standard for the tools schools use now or the ones arriving next. So who checks whether your child's school protects its data right now? Under current Florida law, the answer is no one.
Federal law protects student records under the Family Educational Rights and Privacy Act, or FERPA. Florida law requires notification after a breach happens. It does not require the security program itself, the training, or the incident reporting the state already demands of its own agencies before anything goes wrong.
Schools have closed a gap like this before. When the internet became a fixture in classrooms in the 1990s, boards did not wait on Tallahassee for a policy. Districts wrote their own internet rules years before Congress passed the Children's Internet Protection Act in 2000. They hired someone to manage web filters and trained staff in safe use. Schools moved first.
That same choice sits in front of every Florida school board today. You do not need a new law to start. You need someone accountable for the answer, whether that is existing staff or outside help. That work does not replace your IT provider. It gives your board the policy, training, and accountability structure the state never required.
Florida lawmakers can close this gap the way they closed it for cities and counties. Extend the same standard and training to schools. Fund support through the Florida Digital Service. A school holding your child's health record and Social Security number deserves the same protection Florida already requires for the county tax office.
The 2018 breach in Leon County did not change the law. Neither did Broward. Neither did the Canvas breach. Every year this gap stays open, the risk grows with every new AI tool schools adopt.
Your child's school should not need its own breach before someone builds that oversight. It can start building it now.
This is the work I do. I help Florida school boards build the governance, policy, and accountability structure the state never required, without replacing the IT provider already on staff. If your board hasn't assigned this yet, grab 15 minutes with me: https://meet15.kenneththomas.com
Find out more information at https://kenneththomas.com
Read the original column at the Tallahassee Democrat:
