NYC schools audit finds 141 data breaches, delayed breach notification
New York State Comptroller's audit found NYC public schools experienced 141 data breaches between 2023 and 2025, with inadequate privacy policies and delayed breach notifications. Auditors identified missing cybersecurity controls and training gaps as the system expanded use of educational technology and AI applications.
What happened
A 2026 audit by New York State Comptroller Tom DiNapoli found NYC public schools suffered from glaring omissions in student data privacy policies. Between 2023 and 2025, the comptroller's office documented 141 breaches and inadvertent data releases.
Auditors found the city's school system lacks written policies on risk assessment and data backups, and does not keep a full list of all applications used by local schools. More than a quarter of school employees skip annual cybersecurity trainings.
Reported impact
In 141 breaches and inadvertent data releases, the comptroller's office found officials delayed reporting 48% of incidents to the New York State Education Department, and held up notifying families about 11% of the time. Delayed notifications ranged from 1 to 460 days.
State Comptroller DiNapoli stated that local education officials may fail to report incidents or notify families in a timely manner if a breach occurs.
Index analysis
The audit raised fresh concerns about the embrace of artificial intelligence in the classroom as schools expanded use of educational technology applications without adequate privacy protections.
Governance controls
Schools Chancellor Kamar Samuels provided initial guidance on AI in the classroom in March 2026, with a full playbook planned for the following month. Growing resistance to AI and education technology prompted the chancellor to pause a controversial plan to open the city's first AI-focused high school.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.