Start with three moves: expect scam messages that use the breach as bait, consider a free credit freeze for any child under 16, and keep the notice. Do not click links in unexpected messages about the breach, and reach the school through contact details you already know.
Read the notice before reacting
A breach letter should say what happened, which kinds of information were involved and what the organisation is doing. Note the date, the sender and any reference number. If something is unclear, ask the school in writing. Facts vary a lot between incidents, so avoid assuming your child's data was or was not involved until the notice says so.
For an example of how a large education incident was reported, see our write-up of the PowerSchool breach.
Expect scam messages
Breaches create openings for impersonators. The FTC describes phishing messages that pose as trusted organisations, claim a problem with an account or a payment, and push you to click a link. Real companies do not usually ask you to update payment details through a link in an email or text.
Steps the FTC suggests:
- Treat a message from someone you have no account with as a likely scam: report it and delete it.
- If you do have an account, contact the organisation using a phone number or website you already know is real, not the contact details in the message.
- Forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM), and report at ReportFraud.ftc.gov.
- If you clicked a link or opened an attachment, update your security software and run a scan.
A fake "breach follow-up" from the school is a plausible trick. Call the front office to check before acting on any message that asks for money or a login.
Protect the child's credit file
The FTC says a parent can request a free credit freeze for a child under 16, which makes it harder for someone to open accounts in their name. Details are in our freeze guide. If you responded to a phishing message and personal information may have been exposed, the FTC points to IdentityTheft.gov.
Tidy up accounts
- Change the password on any account that shares a password with the breached service, and stop reusing passwords. See family password habits.
- Turn on multi-factor authentication on email, because email resets the rest.
- Keep a short note of what you did and when.
Quick check
The breach email has a link to check if we are affected. Should I click?
Be careful. Verify the message by contacting the school or vendor using a phone number or site you already know, not the one in the email.
Is a credit freeze worth it for a young child?
The FTC says it is free for children under 16 and makes it harder for someone to open accounts in their name.
Sources
Last reviewed: 19 October 2026.
