New York City’s Schools Face Challenges in Data Security
A recent report from the New York State Comptroller’s office highlights significant issues within the city’s public school system regarding technology tracking and data security. The audit reveals that the schools struggle to monitor which technologies are in use, report data breaches promptly, and inform families when their children’s data may have been compromised.
Comptroller Thomas DiNapoli released this audit just before a large ransomware attack disrupted access to the online education platform, Canvas, affecting numerous educational institutions. Among those impacted were New York City schools, as well as Columbia, Rutgers, and Princeton Universities.
In a statement, Schools Chancellor Kamar Samuels acknowledged two recent data privacy issues: one was a broader problem affecting several schools, believed to be linked to the Canvas attack, while the other was confined to a single campus where malware was discovered in a shared computer lab.
The audit, which reviewed data from March 2020 to September 2025, found that the city’s public schools—serving around 900,000 students across 1,600 schools—lack a complete list of applications used by each school. This gap means the district does not fully understand the risks related to the data it holds.
Auditors examined 141 data breaches reported between January 2023 and February 2025 and noted that nearly half were not reported to the state in a timely manner, with some delays exceeding a year.
Tina Kim, the deputy comptroller for state government accountability, stressed the importance of having a centralized inventory of applications. Without such a list, the district struggles to perform necessary risk assessments and implement adequate security measures for higher-risk applications.
Moreover, the audit pointed out that the school district’s policies lacked clarity on data security and privacy and that related information was not easily accessible on its website. Alarmingly, about 25% of the district’s 161,000 employees had not completed required data privacy training for 2024.
Kim also noted the evolving threats of phishing attacks, pointing out that advancements in artificial intelligence make these attacks harder to identify, increasing the need for training.
Although New York City Public Schools did not reply immediately to requests for comment, Deputy Chancellor of School Operations Kevin Moran stated that ensuring the protection of student data is a top priority for the department. He highlighted a new webpage dedicated to student privacy and a group formed over the past year that includes parents and school leaders to address these issues. While Moran disputed some aspects of the audit’s methodology, the department agreed to most recommendations, including establishing a comprehensive inventory of student information systems and creating a data classification policy.
The comptroller’s office plans to follow up in a year to assess the district’s progress in implementing these important recommendations.
