Scholastic Exposes 4.2 M Customer Records in January 2025 Data Breach
What Happened — In January 2025 Scholastic disclosed that an unauthorized party accessed its customer database, exposing 4,247,768 records containing email addresses, names, phone numbers, and physical addresses.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in privacy‑focused controls that a continuous assurance program would monitor and evidence.
- Demonstrates the need for documented data‑handling policies, encryption, and regular privacy‑impact assessments to provide a defensible audit trail.
- Aligns with the control objective of protecting personal data and maintaining privacy governance.
Who Is Affected – Education publishing, schools, parents, and students whose contact information was stored by Scholastic.
Recommended Actions –
- Conduct a privacy impact assessment of all personal data stores.
- Verify encryption at rest and in transit for the exposed fields.
- Update data‑retention and access‑control policies; log and monitor privileged access.
- Collect evidence of these controls for audit readiness (e.g., GDPR, NIST CSF).
Source: Have I Been Pwned – Scholastic breach
Technical Notes – The breach details do not disclose a specific exploit; the attack vector remains unknown. Exposed data types include email addresses, full names, phone numbers, and physical mailing addresses.