Criminal does immoral thing, imagine that! The issue is that the data isn’t being stored securely in the first place. If it’s not encrypted the game is over as soon as they steal it the data. More needs to be done to ensure the safe storage of this highly sensitive information, and sorting as little of it as possible in as few places as possible. Schools are not equipped to handle this data themselves it needs to be entrusted to an entity (private/government/whomever) that has the time and expertise to keep it securely and properly manage secure access when needed.