CEOS and Boards of Directors:

Toledo, OH — The Toledo Public School System is facing a lawsuit following a cybersecurity breach that exposed sensitive personal information of students and staff, including names, dates of birth, and Social Security numbers. The breach has raised concerns about potential identity theft and other harms to those affected. Legal proceedings were initiated to determine the school district’s liability in connection with the exposure of the data and to assess the adequacy of its cybersecurity measures and incident response. In the wake of the attack, district leadership came under significant scrutiny. Public pressure mounted for a swift and transparent explanation of how the breach occurred and what was being done to mitigate its impact. Deputy Superintendent Jim Gant played a key role in the district’s response. According to sources familiar with the investigation, Gant demonstrated a clear understanding of the district’s cybersecurity framework and helped coordinate the district’s legal and operational response to the incident. These sources indicated that planning steps taken prior to the incident, along with Gant’s cooperation with federal investigators and the district’s timely notifications, were important factors in meeting the district’s legal obligations. While the district itself was ultimately held accountable for the breach, no personal liability was attributed to Gant. Sources close to the matter noted that his role in managing the crisis response helped prevent further fallout at the leadership level.

Los Angeles, CA — After the major cyberattack on Los Angeles Unified School District, Superintendent Alberto Carvalho faced intense scrutiny from parents, advocates, and the media over the district’s handling of the breach. Many in the community expressed frustration with what they saw as inconsistent and limited communication from district leadership, especially regarding whether sensitive student and staff information had been compromised. Carvalho repeatedly assured the public that the data release was limited and insisted there was no evidence of a widespread leak of truly sensitive or confidential information. However, independent investigations revealed that the breach was more severe than initially disclosed, with thousands of files-including student psychological evaluations, Social Security numbers, and other highly sensitive records-leaked on the dark web. The district ultimately acknowledged that approximately 2,000 student assessment records, including psychological evaluations for both current and former students, were exposed. This revelation fueled further demands for transparency and accountability, as parents and legal advocates criticized the district for failing to notify affected families promptly and for not acting on known cybersecurity vulnerabilities. Lawsuits were filed alleging that the district’s mitigation efforts were inadequate and that LAUSD violated state data breach notification laws. The fallout from the breach has left many families worried about the long-term risks to their children’s privacy and has intensified calls for stronger data protection measures in public schools