A widely used online education platform has disclosed a data breach affecting the personal records of millions of students, teachers, and school administrators across the country. The compromised data includes names, email addresses, school affiliations, grades, attendance records, and in some cases, the Social Security numbers of adult users.

The breach occurred when attackers exploited a vulnerability in the platform's API layer, allowing them to query and extract user data without proper authorization. The vulnerability had existed in the platform's code for over a year and had been overlooked during multiple security reviews.

The exposure of minors' educational records is particularly concerning from a regulatory standpoint. Platforms collecting data on children in the United States are subject to strict privacy laws, and failure to adequately protect such data can result in severe penalties under the Children's Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA).

"Educational data is deeply personal and can have long-lasting implications for the children involved," said a child privacy advocate. "This breach is not just a technical failure — it's a failure to fulfill the duty of care owed to students and their families."

The platform has patched the vulnerability and is cooperating with investigators. Schools and parents are being notified, and the platform is offering affected users enhanced account security features and guidance on protecting their information.