Desk live·
ForensicPost
Breaches/Analysis/File 25-0927

Every Remediation Mechanism in This Corpus Assumes an Adult

Children appear in this database as data subjects in education platforms, healthcare records and childcare settings. Every remediation mechanism the corpus records assumes an adult who can act.

Constructed geometry · not a chart of case data
TargetChildren as data subjects
ActorMultiple
D. Kennedy12 min readConfidence: medium2 sources reviewed

This file collects what the corpus can say about children as data subjects, prompted by the nursery incident at 25-0926.

The Exposures Are Already Substantial

62.4 million students claimed at PowerSchool, at 25-0105, followed by extortion emails to individual districts at 25-0507. Thirteen million accounts at an education platform at 26-0414. A university holding people for life at 26-0518. And a childcare setting at 25-0926.

Children are not a marginal category in this database. They are among the largest affected populations in it.

Every Remedy Fails For A Different Reason

Credit monitoring requires a credit file, and a child does not have one — the argument at 26-0113. Notification requires a data subject who can receive and act on it. Litigation settlements at 25-1031 require documented out-of-pocket loss, which a seven-year-old does not have and will not have until the fraud surfaces two decades later.

The compensation ledger at 25-1227 found that money reaches people only where loss is quantifiable. For a child, the loss is maximally unquantifiable: real, permanent, and not yet manifest.

And Consent Is A Fiction In Every One Of These Files

A district selects a student information system. A parent selects a nursery. In neither case does the child agree to anything, and in most cases neither does the parent to the specific vendor — the concentration structure at 25-0105.

The corpus filed absent consent for crash-report subjects at 25-0612 and declined loan applicants at 25-1105. Children are the case where absence of consent is not an accident of the mechanism but a definitional feature.

What Would Help

Identity freezes available from birth, defaulted on rather than requested. Statutory retention limits for education records. A prohibition on retaining childcare-setting material after a child leaves.

All are administratively achievable and none appear in the 2025 regulatory reforms at 25-1113 or 25-0117. Graded medium: this is a synthesis across the database rather than a finding from a source.

This is an analysis file

It collects and reasons about the incidents involving children recorded in this database. Sources below support the underlying cases. Corrections: corrections@forensicpost.com.

Sources
  1. Kido International cyberattackWikipedia
  2. What PowerSchool won’t say about its data breach affecting millions of studentsTechCrunch
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary