Talawanda City school board waives privilege to release cyber-investigation executive summary after Google Calendar data exposure

The Talawanda City School District Board of Education voted 5-1 on March 26 to waive attorney-client privilege for the executive summary of a cybersecurity firm’s report into a Dec. 19, 2024 data exposure that allowed unauthorized access to student individualized education program (IEP) documents and staff calendars, board members said.

The board adopted a resolution specifically waiving privilege only for the executive-summary report dated March 20, 2025, produced by the district’s outside cybersecurity investigator and engaged through the board’s legal counsel. The resolution authorizes the district treasurer to release that executive summary and to take any policy steps necessary to carry out the release.

Why it matters: Board members and public speakers said the release was necessary for transparency after confidential student information appeared online and community members publicly demanded answers. The board’s action makes the executive-summary findings available for public-records requests while keeping other privileged communications protected, according to the resolution language read at the meeting.

Board member remarks and investigation findings Board member Dr. Howard (board member) summarized the district’s response and the primary findings the board disclosed after the vote. According to that summary, the district’s cyber-insurance carrier connected the board to a cybersecurity firm (identified in board remarks as SureFire Cyber), which examined Google Calendar logs and produced a report. The executive summary the board authorized for release is…