Prince William County Schools Accidentally Exposes Parent and Student Data to Third-Party Vendor
Prince William County Schools (PWCS) disclosed an unintended data exposure involving parent and student information shared with Hazel Health, a contracted provider of mental telehealth services. The incident occurred after the district mistakenly transmitted personally identifiable information (PII) for families who had not opted into the program.
The error came to light on December 16, 2025, when affected parents received unsolicited welcome texts from Hazel Health. The exposed data included parent details—such as names, phone numbers, email and physical addresses, guardian status, and relationship to the student—as well as student information, including names, birth dates, gender, grade levels, student and district ID numbers, state testing IDs, and school-specific data (e.g., school name and address).
PWCS confirmed that the disclosure was accidental and that Hazel Health, an approved vendor with verified data security standards, had already destroyed the improperly shared information upon discovery. The district has since corrected the data file and updated internal processes to prevent future incidents.
Parents were notified via a letter outlining the breach and their rights under the Family Educational Rights and Privacy Act (FERPA), with contact information provided for further inquiries. No evidence suggests the data was misused, but the incident highlights risks in third-party vendor data handling within educational institutions.
Hazel Health TPRM report: https://www.rankiteo.com/company/hazelhealth
Prince William County Schools TPRM report: https://www.rankiteo.com/company/prince-william-county-schools
"id": "hazpri1767116855",
"linkid": "hazelhealth, prince-william-county-schools",
"type": "Breach",
"date": "12/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Parents and students who had '
'not opted into Hazel Health '
'services',
'industry': 'Education',
'location': 'Prince William County, Virginia, USA',
'name': 'Prince William County Schools (PWCS)',
'type': 'Educational Institution'}],
'customer_advisories': 'Letter sent to affected parents explaining the '
'incident and steps taken',
'data_breach': {'data_exfiltration': 'No evidence of exfiltration, but data '
'was shared unintentionally',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (Personally Identifiable '
'Information)',
'type_of_data_compromised': ['Parent contact details (name, '
'phone number, email, physical '
'address, guardian status, '
'relationship to student, '
'contact order preference)',
'Student information (student '
'ID, district ID, state testing '
'ID, name, gender, birth date, '
'grade level, school details)']},
'date_detected': '2025-12-16',
'date_publicly_disclosed': '2025-12-16',
'description': 'Prince William County Schools (PWCS) inadvertently shared '
'parent and student information with Hazel Health, a '
'third-party mental telehealth service provider, for families '
'who had not opted into the service. The error was discovered '
'when parents received a welcome text from Hazel Health. PWCS '
'took immediate steps to ensure Hazel Health destroyed the '
'mistakenly shared information.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to PWCS',
'data_compromised': 'Personally identifiable information (PII) of '
'parents and students',
'identity_theft_risk': 'Increased risk due to exposure of PII',
'legal_liabilities': 'Potential FERPA violations'},
'investigation_status': 'Incident contained and remediated',
'lessons_learned': 'Need for stricter data sharing controls and process '
'reviews to prevent unintentional disclosure of PII.',
'post_incident_analysis': {'corrective_actions': 'Corrected data file and '
'updated internal processes '
'to prevent recurrence',
'root_causes': 'Inadvertent data sharing due to '
'process error in opt-in consent '
'enforcement'},
'recommendations': ['Review and update data sharing agreements with '
'third-party vendors',
'Implement additional safeguards to ensure opt-in consent '
'is strictly enforced',
'Conduct regular audits of data sharing practices'],
'references': [{'date_accessed': '2025-12-16',
'source': 'Prince William County Schools (PWCS) Parent '
'Letter'}],
'regulatory_compliance': {'regulations_violated': 'Potential FERPA '
'violations'},
'response': {'communication_strategy': 'Sent a letter to parents explaining '
'the incident',
'containment_measures': 'Ensured Hazel Health destroyed the '
'mistakenly shared information',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Corrected the data file and updated '
'internal processes to prevent future '
'incidents'},
'stakeholder_advisories': 'Parents advised to contact PWCS FERPA Officer for '
'questions or concerns',
'title': 'Prince William County Schools Unintentional Data Sharing with Hazel '
'Health',
'type': 'Data Breach'}