School systems collect and maintain increasingly significant amounts of data and information on students, faculty, and staff and have a duty of care to ensure that sensitive information remains secure. Therefore, sitting and/or aspiring school leaders need to develop at least a basic understanding of data privacy and information security considerations. In this case, students discover a way to log in to internal district information systems and gain access to sensitive school and district data and information. School and district leaders are faced with the challenge of how to respond to such an information security breach and how to discipline the students. This case should cause sitting and/or aspiring school leaders to think deeply about and examine technology policies, information security protocols, as well as related school discipline policies.