Permanent Record: How School Data Breaches Put Your Child's Identity on the Market
The OPSEC Podcast: Privacy & Security for Life in the Digital AgeShow Notes
Public schools have become one of the softest, highest-value targets in the ransomware economy. They hold enormous amounts of sensitive data on children, run on tight budgets with little security staff, and depend on third-party vendors that keep getting breached. This episode maps the current threat landscape: the PowerSchool breach that exposed roughly 62 million students and 9.5 million teachers, the Canvas breach that became the largest education breach on record, the always-on monitoring software watching half the students in the country, and the collapse of the federal support that many districts relied on. Then it covers what districts have to do and, more importantly, what parents and students can actually control. The single highest-leverage action for a parent: freeze your child's credit.
Defenses and Resources
For districts (CISA guidance): Protecting Our Future: Cybersecurity for K-12 (CISA) Cybersecurity for K-12 Education (CISA) K-12 Ransomware Resources (CISA StopRansomware) K-12 Cyber Incident Map (K12 SIX)
For parents and students: How to protect your child from identity theft, including freezing a child's credit (FTC) FERPA and your rights over education records (U.S. Dept. of Education) Children's privacy and COPPA (FTC)
Priority Actions 1. Freeze your child's credit at all three bureaus (Equifax, Experian, TransUnion). Free, and it blocks new accounts opened with a stolen SSN. 2. Treat any breach notice as real. Take the free monitoring, but know the freeze is what actually prevents fraud. 3. Ask your district what SIS, LMS, and monitoring software it uses, what data each holds, and for how long. 4. Use the opt-outs you already have (FERPA directory information; COPPA protections for younger kids). 5. Decline optional apps and accounts. You cannot leak what was never collected. 6. Talk to your kid: a school device is not private, and what they type on it is recorded.
If your child is in school, freeze their credit this week. It is free, it takes about an hour across the three bureaus, and it closes the exact door a data breach opens. Do that first.
Then send one email to your district and ask three questions: what student information system do you use, what monitoring software runs on my child's device, and how long is my child's data retained. You are entitled to ask, and asking tells them parents are paying attention.
Head to OPSECPodcast.com for the full episode and every link.
Your privacy and your security is your responsibility.
More from The OPSEC Podcast: Privacy & Security for Life in the Digital Age
In this episode, I sit down with a political insider who has spent over 20 years working elections at the state and national level, plus consulting with governments and NGOs on public policy. He's been inside the machine that feeds the data swamp, offering answers to the voter privacy failures and campaign vulnerabilities I can only gesture at from the outside.
# The Voter File: Voter Data Brokers, Political Profiling, and Protecting Your Privacy You registered to vote. In nearly every state, that created a public record that voter data brokers can buy, enrich, and resell. This episode follows your registration from the county clerk into a private industry that fuses it with everything else known about you, builds political profiles that score your beliefs and your money, and sells the result. Roughly two hundred million registered Americans are in these files, and none of them consented to any of it. This is not about parties or who you vote for. It is about your data. ## In This Episode - What your state voter file actually contains, and the one thing it never contains: who you voted for. - Why the public half of the record is already enough to find you, address you by name, and reach you at home. - How a public record becomes a product through four layers: acquisition, standardization, enrichment, and modeling. - Enrichment: how commercial consumer data gets bolted on, with an industry claim of up to 1,800 fields per person. - Modeling: how a stranger's algorithm assigns you scores and predicted positions, then sells the guess as a fact about you. - What actually gets sold: universes, contact lists, scores, survey panels, and match services. - Why this is not a one-side story, and why the newest buyer, government agencies purchasing through commercial brokers, changes the threat. - Why the file leaks at the vendor layer, not the state, including the contractor that left modeled profiles on roughly 198 million Americans open on the internet. - Why the "non-commercial use only" restriction is an attestation, not a control. ## Key Takeaways - You cannot fully opt out of the voter file. Anyone who says otherwise is selling something. But you can shrink what makes it dangerous. - The real threat is not that you are a target. It is that your enriched profile lands in an investigation or a database that has nothing to do with you. - The one genuine opt-out is an Address Confidentiality Program (Safe at Home), and most people are not eligible. Check anyway. - The part you can actually fight is the enrichment layer. Break the commercial data bolted onto your record and a rich dossier becomes a thin one. - Stop feeding the same address into everything else, so your registration becomes a dead end instead of a master key. ## Do This Week 1. Look up your state's Address Confidentiality Program through your Secretary of State and find out if you qualify. If you do, enroll. 2. Start or restart your data-broker removal to attack the enrichment layer. 3. Separate your registration address from your car, deliveries, accounts, and loyalty cards where you legally can. ## Resources - U.S. Election Assistance Commission, voter lists, confidentiality, and list maintenance: https://www.eac.gov/election-officials/voter-lists-registration-confidentiality-and-voter-list-maintenance - NNEDV Safety Net, Voting and Survivor Privacy: https://www.techsafety.org/voter-registration-privacy - Your state Secretary of State website: search "[your state] Address Confidentiality Program" or "Safe at Home." ## Connect Subscribe and follow wherever you listen, and find every link at OPSECPodcast.com. Sign up for the newsletter at OPSECPodcast.com for the latest tools and tradecraft. Remember: your privacy and your security is your responsibility.
Ghost Signal: Ghost Signal: AI Voice Cloning Threats and Protecting Your Family From Digital Fraud For your whole life, a familiar voice has been proof of identity. A few seconds of audio from a social media clip is now enough to clone the voice of someone you love, and many cloning tools ask for little more than a name and an email address. This episode breaks down how AI-powered social engineering attacks get built, the three plays aimed at everyday people, and the free, low-tech protocol that beats all of them. In This Episode - What actually changed: AI removed the skill barrier from impersonation, and why "look for the typos" is now dangerous advice. - The assembly line: reconnaissance, pretext, voice clone, stacked channels, and manufactured urgency. - The three plays that do most of the damage: the family emergency call, the fake bank fraud call that asks for your code, and the message that knows your life. - How deepfake video is used to override a target's own suspicion. - Why the FBI now tells families to set up a secret word. - Why your family's public posts work as source material, and the military discipline of emissions control. Key Takeaways - A familiar voice or face is no longer proof of identity. Trust needs a protocol. - Every one of these attacks depends on urgency and on keeping you inside the attacker's conversation. Step outside it and the attack falls apart. - An AI can clone a voice from a video, but it cannot clone a word that was never recorded anywhere. - No bank, agency, or support line will call you and ask you to read back a code. If someone does, it is an attack. - A hardware security key cannot be talked out of you over the phone. - The people most likely to get the call are your parents and grandparents. Brief them with a specific rule, not a general warning.
Summary: Every financial transaction creates a permanent record: at the bank, the card network, the payment app, the data broker who purchased it, and the government reporting infrastructure mandated by the Bank Secrecy Act. This episode maps the complete architecture of financial surveillance—from 78,000 government reports filed daily, to Mastercard's transaction data sales, to Plaid's middleware granting hundreds of apps access to your full banking history. --- What Your Financial Data Reveals: - Health conditions (pharmacy patterns, clinic visits) - Political activity (donations, event venues) - Religious practice (charitable giving, places of worship) - Relationship status (dining, travel, shared accounts) - Financial stress (overdrafts, payday lenders, credit utilization) - Daily schedule and location patterns - Household composition --- Key Takeaways: - The Bank Secrecy Act generates massive surveillance as a compliance byproduct—most unrelated to actual crime - Structuring laws mean using cash incorrectly can itself be a federal crime, regardless of intent - Card networks (Mastercard, Visa) sell transaction data commercially; "anonymization" claims are disputed - Plaid aggregates your banking history and shares it with every connected app—most users don't know what they've authorized - Your financial profile is more detailed than your own memory of spending, accessible to multiple commercial and government actors --- Key Actions: 1. Audit Plaid connections: Visit plaid.com/connections to see every app with bank access. Revoke anything unused or unrecognized. 2. Get virtual cards: Use Privacy.com to generate merchant-specific card numbers with spending limits. Free tier available. 3. Read your bank's privacy notice: Exercise your legal right to opt out of third-party data sharing. Banks must offer it; few customers do. 4. Use cash strategically: For medical, personal, and sensitive purchases where you don't want a commercial record. 5. Don't structure deposits: Breaking up cash deposits below $10,000 to avoid Currency Transaction Reports is a federal crime—regardless of whether any underlying crime exists. --- Resources: - FinCEN: Bank Secrecy Act Overview - FinCEN: Currency Transaction Report FAQ - Privacy.com: Virtual Cards - Plaid: Manage Your Connections - PIRG: Mastercard Data Sales Practices - Cato Institute: BSA Reporting Volume FY2025 --- Call To Action: This week, go to plaid.com/connections and revoke every app you don't actively use. It takes five minutes, and you'll almost certainly find connections you forgot you created. Then read your bank's annual privacy notice and opt out of third-party data sharing. It's required to be offered. Exercise it. Your financial record is a behavioral profile. The question is who has access to it. Head to OPSECPodcast.com for everything else. Your privacy and your security is your responsibility.