The FBI Confirmed It: A School District's Student Data Was Stolen

Intro — The Correction, and What the FBI Told Springfield

Welcome to The Tech Radar for Parents. I'm your host, Weston, brought to you by Nicholas D. West Tech LLC. This is your briefing for the week of September fourteenth, 2026.

Last week I told you about Springfield, Massachusetts, the district that lost an entire week of school to a cyber incident, and I asked you to go find out where your own district keeps the allergy list when the network is down. Springfield's kids went back to school on Monday. And on Tuesday evening, the F B I told the district what we were all afraid of. The data was taken. Staff Social Security numbers, possibly. And for students, addresses, ages, ethnicities, and medical information.

That's the ugly this week, and I'll walk you through exactly what is known, what isn't, and the one thing you can do about it this weekend that most parents have never heard of.

But first, I owe you two things. The first is a story I missed. On Thursday, September tenth, the same day I recorded last week's episode, the Governor of California signed thirteen laws about kids and technology in one sitting. The strongest chatbot and social media rules in the country, on paper. I didn't have it. So this week it's the good, and I'm going to spend real time on it, including the part every headline skipped, which is that not one of those laws is in force yet.

The second is a correction, and it's on me. Two weeks running I told you that nobody had reported whether Meta filed its appeal of the nine hundred forty two million dollar New Mexico judgment. Somebody had. On Wednesday, September ninth, the day before I recorded, the Santa Fe New Mexican reported that Meta had filed more than a dozen post judgment motions on the Friday before Labor Day, asking Judge Biedscheid to redo nearly all of his findings, cut the abatement fund from five hundred sixty seven million dollars to about sixty million, or grant a new trial. Those motions stop the appeal clock until he rules, and he has not set a hearing. So there was no deadline to miss, there is no appeal yet, and there won't be one until the judge rules. I said I didn't know. The answer was sitting in a newspaper, and I missed it.

So here's the plan. The good, California's thirteen laws and the dates that actually matter. The bad, a national survey that says the school phone bans held on paper and slipped in the classroom, and that most of us didn't notice. The ugly, what the F B I told Springfield. A decoder ring with five terms, none of them slang, because it's the eighth week without a new word. And an action plan that starts with freezing your kid's credit.

Let's go.

The Good — California Wrote It Down

Let's start with the good, and this week the good is a stack of paper in Sacramento.

On Thursday, September tenth, Governor Gavin Newsom signed thirteen bills in Marin County, and the way he put it is the way a lot of you have put it to me. Quoting, Parents can't compete. Can't compete with the engineering, can't compete with the algorithms. You feel like you're a lousy parent. Here are the four that matter most.

Assembly Bill seventeen oh nine, from Assemblymember Josh Lowenthal. A platform may not give a user under sixteen what the law calls an addictive feature. That means an algorithmic feed built from what the kid has watched, and autoplay. A kid under sixteen can still have an account. They just can't have the feed. Only the Attorney General or a local prosecutor can enforce it, at twenty five thousand dollars per affected minor if the company was negligent, and fifty thousand if it knew. The Electronic Frontier Foundation opposed it as well intentioned but deeply flawed, and the industry group that sued over California's last feed law is expected to sue over this one. Worth knowing, that last law survived at the Ninth Circuit a year ago.

Senate Bill eleven nineteen, from Senator Steve Padilla. It's called Adam's Law, after Adam Raine, a California teenager who died by suicide last year after months of conversations with ChatGPT. For a user the company knows is a child, a companion chatbot has to cut a single session off at one hour, and cap the day at two. It has to have a written crisis protocol for self harm. It has to notify a parent, quoting, as soon as practicable, when there is a credible, imminent threat. It has to do a documented risk assessment before launch, and an independent child safety audit by twenty twenty nine. And a child or a parent can sue for actual damages and attorney's fees. OpenAI supported the bill.

Assembly Bill two. If a big platform, over a hundred million dollars in revenue, fails to use ordinary care and injures a child, the family can sue. Five thousand dollars per violation up to a million dollars per child, or three times the actual damages, whichever is more. And Senate Bill eight sixty seven, a four year moratorium on companion chatbot toys for children under sixteen.

Now the part the headlines skipped.

None of it is in force today. Adam's Law says, in its own text, that it becomes operative on July first, twenty twenty seven. Assembly Bill seventeen oh nine has no operative date at all, which in California means it starts January first, twenty twenty seven, unless a court stops it first. And all of it applies to California residents. If you live in Alabama, or Ohio, or anywhere else, nothing on your kid's phone changed on Thursday.

So why is this the good? Because for the first time, a state wrote down the numbers. One hour a session. Two hours a day. No feed under sixteen. You don't need to wait for July to use them.

The Bad — The Phone Ban Slipped

Now the bad, and this one is about us.

A year ago, most of the country's schools restricted phones for the first time. Last Thursday, September tenth, the day before our window opened, so I'm labeling it, Brookings published what a national panel of teenagers said about how that year actually went. The researchers are Dan Silver, Amie Rapaport and Morgan Polikoff at the University of Southern California's Center for Applied Research in Education. They asked the same teens twice, in October of last year and again in May, through the Understanding America Study, which is a probability panel, not an online poll.

Fifty six percent of the teens were at schools with a bell to bell ban. Phones away from the first bell to the last, lunch and passing periods included. The other forty four percent had something looser.

Here's what happened over the year. In October, twenty eight percent of teens said they'd used their phone during a core class. By May, forty two percent. At the bell to bell schools it went from twenty five to thirty five. At the looser schools, from thirty two to fifty.

So the policy held. The enforcement didn't.

Forty four percent of the teens said their teachers got less strict about the phone rules as the year went on. The researchers asked the adults in the same households, mostly parents and grandparents, the same question. Thirteen percent noticed. Forty four versus thirteen. The kids watched it slip. We didn't.

And here's the strange part, the part that makes this the bad and not the ugly. The kids got happier about it. In October, forty eight percent said the phone rules were making them unhappy. By May, twenty seven. One of them wrote, I was able to pay more attention this school year since our phones were locked in pouches. There were less distractions. The resistance faded. The enforcement faded with it. Those two things should not have happened at the same time, and they did.

One more number. Fifty eight percent said the school rule had no effect on their phone use outside school. Thirty percent said they used the phone more outside school because of it. A school policy is a school policy. It was never going to be the whole answer.

The Ugly — Springfield, Part Two

Now the ugly. Springfield, Massachusetts, part two.

Quick recap. Springfield Public Schools, second largest district in the state, sixty six schools, about twenty seven thousand students, closed Tuesday through Friday last week for what it called a level four severe cyber incident. The systems that went dark included the third party platforms holding student medical and transportation records. Nurses could not see medications or allergies.

On Monday, September fourteenth, the kids went back. Superintendent Sonia Dinnall called it their second first day of school. Phones were back by Friday. Backup internet was up in most buildings, and the main system was still down. Teachers taught from books, paper and overhead projectors. That same Monday, Assistant Superintendent Jose Escribano said, quoting, we're not saying that any information was compromised at this time.

Tuesday evening, that changed. The F B I notified the district that its data had been breached by a cybercriminal organization. The organization has not been named. Here is what the district said may be in the files. For staff, Social Security numbers, possibly, not confirmed. For students, quoting the district's own words as reported Wednesday, addresses, ages, ethnicities, medical information and more. The district says it does not normally keep student Social Security numbers in those files.

Here's what the district is doing. Free credit monitoring, expedited, for all district personnel. That's staff. As of Wednesday, nothing had been announced for students, whose addresses, ages and medical information are the ones on the list.

Here is what is not known, and this is where I have to be more careful than the headlines. No official has confirmed a ransom demand, and no official has named the group. Mayor Domenic Sarno has said he will not negotiate a ransom, which is not the same as saying one was made. But on Tuesday afternoon, a ransomware gang called Interlock, the one the F B I and CISA put out a joint advisory about last July, posted Springfield Public Schools on its dark web leak site. The tracker ransomware dot live logged the posting just before three in the afternoon Eastern. The posting describes student databases with last name, first name, student number, enrollment status, grade level, home address, home phone number and ethnicity, plus, in its words, medical information. That matches, almost field for field, what the district said the next day. No local outlet has reported the claim, the district has not confirmed it, and I cannot verify what the gang actually holds. So here is the precise version. The district has not said ransomware. A ransomware group has said Springfield.

Superintendent Dinnall, on Wednesday. Quoting. Springfield Public Schools just happened to be in the crosshairs of these criminals. And, in this day and age, we all should be hyper vigilant around our personal identifying information. The district will shorten December break to make up the four lost days.

So last week I asked you to find out where your district keeps the allergy list when the network is down. This week the question is harder. When the allergy list is stolen, what does the district do for the kids on it? Springfield, so far, has an answer for the staff.

One more, because it did not stop. The Cat in the Hat trend, the A I made threat images that got more than ten kids arrested by last week. On Monday, September fourteenth, an eighth grader at Bailey Middle School in West Haven, Connecticut was arrested for one, posted on TikTok over the weekend. Police called it a hoax and posted two extra units at the school anyway. The charge there is breach of peace. And West Haven police Sergeant Scott Allard gave the clearest instruction I've heard yet, so I'm going to give it to you verbatim. If you do see this, we ask you don't post, you don't repost, you don't comment, you don't do anything. You either let an S R O know if there is one in the school, or you let an administrator know. That was the only new arrest I could verify in the window. I looked.

The Decoder Ring — Five Terms, None of Them Slang

Now the Decoder Ring. For the eighth week in a row, no source in our window documents a genuinely new slang term. So here are five terms that are actually going to matter to you this month. None of them came from a teenager.

Number one. Addictive feature. That's the legal term in California's new Assembly Bill seventeen oh nine. It means two things, an addictive feed, which is content picked for your kid based on what your kid has already watched, and autoplay. The Attorney General can add more by regulation. When your kid says the algorithm, this is the algorithm, and a state just put it in a statute.

Number two. Operative date. Signed is not in force. Adam's Law says July first, twenty twenty seven. The feed law says nothing, which means January first, twenty twenty seven. When a headline says California banned something, ask when.

Number three. Breach of peace. That's the charge in West Haven, Connecticut this week. It's the low end. Last week the same trend was charged as terroristic threats in Alabama and terrorism in Mississippi. The charge depends on the state and the wording of the post, and the kid does not get to pick which one.

Number four. Credit freeze. Not credit monitoring. Monitoring tells you after someone opens an account in your child's name. A freeze stops them from opening it. Under federal law, a parent can freeze a child's credit at all three bureaus, Equifax, Experian and TransUnion, for free, and a minor's file is often empty, which is exactly why thieves like it. Springfield is offering staff monitoring. Nobody has offered the students a freeze, because nobody can. Only you can.

Number five. Bell to bell. Phones off and put away from the first bell to the last, lunch and passing periods included. In the U S C survey, fifty six percent of teens had it, and it held better than the looser rules, a ten point slide instead of eighteen. Better is not the same as held. Ask which kind your school has, and then ask whether it's still true in May.

Your Weekly Action Plan (1–2)

Here is your action plan for the week.

One. Freeze your kid's credit this weekend. This is not just for Springfield. Go to Equifax, Experian and TransUnion, find the page for a minor's credit freeze, and follow it. You will need proof that you're the parent and proof of the child's identity. It is free, it takes an evening, and it stays until you lift it. If your district has had a breach, add one more step. Ask, in writing, which student fields were in the files, and whether students are being offered monitoring, not just staff. Springfield's answer as of Wednesday was staff only. Your district's answer should be on paper.

Two. Ask the teacher, not the district. The policy is on the website. The enforcement is in the room. Ask your kid's core teachers one question at conferences, is the phone rule enforced in your class today the way it was in September? And ask your kid the same thing on the drive home. Forty four percent of teens said their teachers eased up over the year, and thirteen percent of parents noticed. Be in the thirteen.

Your Weekly Action Plan (3–4)

Three. Use California's numbers tonight, wherever you live. One hour per session, two hours a day, on any companion chatbot. Screen Time on the iPhone and Family Link on Android both let you set a daily limit per app, so set it on ChatGPT, on Character A I, on Replika, on whatever your kid actually uses. And turn off autoplay wherever the app lets you. YouTube has a switch for it. A California company has until July of twenty twenty seven to do this for California kids. You have until bedtime.

Four. Give your kid the three don'ts. Don't post, don't repost, don't comment. Tell an adult. That's Sergeant Allard's line from West Haven, and it works for the Cat in the Hat and for the next thing, whatever it is. Keep last week's three sentences too. A I made does not mean not real. Snapchat does not disappear. And if you see one, tell me, and I won't be mad you saw it.

Four steps. Freeze the credit. Ask the teacher. Set the limits. Say the three don'ts.

Closing & Outro

So, to recap the week of September fourteenth. California signed thirteen kids and tech laws on the day we recorded last week, including a no feed rule for under sixteens and Adam's Law for chatbots, and not one of them is in force before January. A national survey of teens says the school phone bans held on paper and slipped in the classroom, and the kids noticed while we didn't. And in Springfield, the F B I confirmed the data was taken, student addresses, ages and medical information included, a ransomware gang has claimed it, and so far the credit monitoring is for staff.

Now the part where I tell you what I did not check.

I still did not get into the New Mexico docket. What I have on Meta's motions comes from one newspaper, the Santa Fe New Mexican, and the state has not filed its response yet. I could not verify what the Interlock gang actually holds from Springfield, only that it claimed to. I did not sweep the breach trackers for other districts. I did not find a single new peer reviewed study in the window, the Brookings piece is a survey brief and it came out the day before. Meta's rivals are silent a third week, as far as I can tell. Meta's newsroom I checked through Thursday. TikTok's newsroom would not fully load for our tools, so I'm not claiming I read it. The only teen safety moves from any platform were Threads adding parental supervision in Asia Pacific and Google turning on age estimation in Canada. Neither is here. The Federal Trade Commission's chatbot inquiry turned one year old on Friday with no report. And for the eighth week, no new slang.

One more, and it cuts both ways this time. Last week and the week before, my research system told me whole categories had come back empty and they hadn't. This week it did the opposite. It found Springfield, California, West Haven and the survey, and then its fact checkers caught two things I had wrong in my own draft, the Meta motions and the Interlock claim. I still checked every one by hand. A system being right one week is not the same thing as a system you can stop checking. And that goes for me too.

If you or your child are struggling, call or text 9 8 8. Free, confidential, twenty four hours.

If this was useful, the best thing you can do is like and subscribe. And if you've got thirty more seconds, leave a review. Reviews are free, and they are honestly what lets us keep making this show and keep it free for parents.

I'm your host, Weston, with Nicholas D. West Tech LLC. Freeze the credit, ask the teacher, and I'll see you next week.