Agreed. Three years of student data leaked is pretty severe and a major FERPA violation.