Lower Merion School District BoardDocs system leaks sensitive internal documents

The Lower Merion School District in Pennsylvania is reporting a data leak that inadvertently published an unknown number of highly sensitive internal documents online due to a security flaw in its school board-management software. 

The incident involved BoardDocs, a widely-used platform developed by New York-based Diligent Corporation that helps school districts across the country manage board meetings and post agendas and related information. 

The school district first learned of the breach on April 10, 2025, when it was contacted by a litigant in a legal proceeding unrelated to the breach. The leaked documents included sensitive cases such as investigations into school personnel. 

District solicitor Kenneth Roos explained that internal records from the "executive" section of the BoardDocs site had at some point become accessible to the public, despite being intended for the password-protected area of the platform. School board members were subsequently notified and the problem was resolved.

Exposed Data includes

• Attorney-client privileged legal memos discussing ongoing litigation
• Confidential employee information and personnel matters
• Issues involving students (identified by their initials)
• Investigation details about school staff, including disciplinary matters
• Internal school board executive session documents spanning from 2017 to 2024

The exact number of affected individuals is not disclosed. The district described it as involving an "unknown number" of highly sensitive documents. Diligent Corporation acknowledged the leak was caused by a software defect that allowed confidential documents stored in the executive section to become publicly accessible through the BoardDocs platform. 

Update - as of 12th of June 2025, BoardDocs has declined to disclose the number of school districts that were affected by the incident and said only about 1% of documents stored on BoardDocs were exposed (roughly 64,000 files).
Company spokesperson claims they have began notifying all BoardDocs customers — including those who were not directly affected — on May 30, 
Multiple school districts that contract with BoardDocs said they were unaware of the incident until they were contacted by journalists and, in several instances, received confirmation of the breach from Diligent only after they reached out to the company directly to inquire about whether their own confidential records had been compromised.