Loading story…
A two-year investigation of 100 education-technology applications used in Utah schools found widespread collection and disclosure of student data that appeared to conflict with vendor privacy agreements. The Utah State Board of Education, Brigham Young University, and Internet Safety Labs inspected live network traffic from 2023 through 2025; among 85 applications covered by relevant student-data agreements, 52% collected at least one data element not permitted under those terms.
Across all applications tested, 61% shared data with third parties and 36% transmitted data to advertisers, highlighting the gap between contractual assurances and observed application behavior. Utah responded with H.B. 55, effective July 1, 2026, which requires specified student-data safeguards in vendor contracts and directs schools to terminate contracts when confirmed violations are not remedied after notice.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Utah enacted H.B. 55, Privacy Compliance for Education Technology Vendors, amending Utah Code § 53E-9-309. The law requires specified student-data safeguards in EdTech contracts and requires termination when vendors fail to remedy confirmed violations after notice.
The Utah State Board of Education, Brigham Young University, and Internet Safety Labs conducted a two-year investigation of network traffic from 100 educational-technology applications used by Utah schools between 2023 and 2025.
H.B. 55 took effect, establishing contractual student-data protection, vendor-notification, and contract-termination requirements for Utah education entities.
Utah asked vendors associated with potential privacy issues to explain or correct the identified concerns. Vendors that addressed issues could have their identities redacted from the public report.
Among 85 applications with relevant student-data privacy agreements, 52% collected at least one data element not allowed by the agreement. Across all tested apps, 61% shared data with third parties and 36% transmitted data to advertisers.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcefirstfish.substack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Utah state privacy audit concluded that systemic weaknesses in **access controls**, records request handling, and **incident response preparedness** are putting sensitive child welfare and health information at risk within two Utah Department of Health and Human Services (DHHS) data repositories. The audit—stemming from a May 2025 probe and published by state auditor **Tina Cannon**—characterized the deficiencies as a critical failure to protect vulnerable populations, warning that inadequate safeguards around highly confidential data could enable misuse and long-term harm. The review was initiated following a **whistleblower complaint** from a DHHS employee, according to the state auditor’s office. One of the repositories examined was the **SAFE** system used by the Division of Child and Family Services, with auditors citing inadequate access controls and insufficient incident response planning as key gaps requiring remediation to reduce exposure of sensitive records affecting millions of children and adults in Utah.
Jun 29, 2026
Nearly all 20 U.S. state-run health insurance marketplaces were found to be transmitting sensitive applicant data to major advertising and technology companies through misconfigured web tracking pixels. A Bloomberg investigation reported that data sent from exchange websites included details such as **race**, **sex**, email addresses, phone numbers, ZIP codes, country identifiers, and even whether applicants had incarcerated family members. The recipients reportedly included **Google, LinkedIn, Meta, Snap, and TikTok**, raising concerns that government healthcare platforms leaked protected personal and health-related information at scale. The exposure affected marketplaces used by more than **seven million Americans** buying health insurance this year, significantly widening the potential impact. Specific cases included New York's exchange sharing incarceration-related family information, Washington, D.C.'s exchange sending race and sex data to TikTok, and Virginia removing a Meta tracker after ZIP code sharing was identified. Following the findings, Washington, D.C. paused its TikTok tracker rollout and Virginia removed Meta's tracker, underscoring how embedded analytics and advertising tools on public-sector healthcare sites can create broad privacy risks.
Jun 29, 2026
Canadian privacy regulators released investigative reports attributing significant responsibility for the PowerSchool data breach to the school systems that used the platform. The breach, which occurred in December, exposed personal information of over 62 million students and 9 million teachers, with data in some cases dating back to 1985. The reports highlighted that the affected schools failed to include adequate privacy and security provisions in their contracts with PowerSchool, did not effectively monitor the company's security safeguards, and lacked proper breach response protocols. Additionally, the lack of multifactor authentication and insufficient limitations on remote access for PowerSchool support personnel were cited as key security lapses. The Ontario and Alberta information and privacy commissioners recommended that schools renegotiate contracts to strengthen privacy and security requirements, implement better oversight of third-party vendors, and establish more robust breach response plans. The incident underscores the importance of comprehensive vendor management and the need for educational institutions to enforce standard security practices, such as multifactor authentication, to protect sensitive student and staff data.
Jun 29, 2026