November 10, 2026: Lake County Schools in Florida confirmed that an employee answering a public-records request sent a parent unredacted files covering about 47,000 students, including education records, individualized education plans (IEPs) and disability information. The district has gone to court to have the files deleted. See the Lake County Schools breach record.
The parent requested the records on September 14, 2026. On October 23, a district employee uploaded eight unredacted files instead of the redacted versions. The district first believed about 1,800 records were involved. The parent later said he had more than 47,500 files going back to the 2023 graduating class, and the district has since confirmed about 47,000.
On November 3, the district filed a verified complaint in the Circuit Court of the Fifth Judicial Circuit in Lake County. It asks the court to order the parent to delete the files from every storage location and to provide a sworn statement confirming the deletion. FOX 35 Orlando reported the lawsuit and the school board discussion on November 10.
What happened in the Lake County student data leak?
This was a records-office error, not a cyberattack. No one broke into the district's network. The data left because the wrong files were attached to a lawful public-records response.
School board attorney Scott Cole told the board that only one person currently has the records and that the district's sole aim is to stop further disclosure. According to the district, the parent's attorney said his client had "100s of statutory violations in his hands" and asked what the district would offer in exchange for destroying the files and staying silent. No court date had been set as of the November 10 report.
What data was exposed?
- Education records for about 47,000 students
- Individualized education plans (IEPs)
- Disability information
The board reporting did not mention Social Security numbers or payment information. Even without them, IEPs and disability details are among the most sensitive records a school holds. They are protected under FERPA, the federal student privacy law, and their exposure can lead to bullying, discrimination or misuse in disputes.
Who is affected?
Students whose records were in the eight unredacted files, about 47,000 by the district's count. Because the files go back to the 2023 graduating class, former students are included as well as current ones. Staff records were not mentioned.
If your child never attended Lake County Schools, they are not affected. If they left the district after 2023, their records may still be in the files.
Was the school network hacked?
No. The exposure came from an employee's mistake while answering a records request. Other recent school incidents had different causes: the Frontline Education vendor breach exposed staff data at districts across the country, and Richmond Public Schools was hit by ransomware. Lake County's case is an accidental disclosure followed by a civil lawsuit.
What should Lake County parents do?
- Watch for a letter from the district and check any related website against lake.k12.fl.us.
- Talk with your child about messages that mention their disability, IEP meetings or school services.
- Be wary of anyone who contacts you claiming to hold your child's records or offering to "remove" them for a fee.
- A credit freeze is not needed based on current information, since no Social Security numbers were reported. Revisit this if a later notice says otherwise.
- Follow the court case for updates on whether the files have been deleted.
Frequently asked questions
How many students were affected by the Lake County Schools leak?
About 47,000, according to the district. It first estimated about 1,800 records, but the parent who received the files said he had more than 47,500, and the district later confirmed about 47,000, including records going back to the 2023 graduating class.
Were Social Security numbers leaked?
They were not mentioned in the November 10 board reporting. The files contained education records, individualized education plans and disability information. Those records are protected under federal student privacy law and are highly sensitive even without Social Security numbers or financial details.
Who has the Lake County student files now?
The district says one parent holds them. On November 3, 2026, it filed a lawsuit in Lake County circuit court asking for an order that the parent delete every copy from all storage locations and sign a sworn statement confirming the deletion.
Was this a cyberattack?
No. A district employee uploaded eight unredacted files instead of redacted versions while answering a public-records request on October 23, 2026. No one broke into the network. The incident is an accidental disclosure, and the district is using the courts to contain it.