School: Minister Destiny Testimony Schools Track: Youth Class: Topic Library — Year 1 (Foundations) Presented by: Minister Destiny Marie Morgan, Muslim Ordained Minister
This lesson is educational information and is not legal advice. Laws vary by state. If you are in danger right now, call 911.
Before you start
- This space is private. Nobody sees what you read or answer. Progress stays on your device.
- We never ask your name. Not here, not on the test, not on the certificate. If you earn a certificate, you write your own name on it after downloading.
- Pass the test at 80% or higher to earn this unit's certificate. Retake it as many times as you need. Answers are not shown: go back and find what you missed.
- If you are in danger right now: call 911. If you cannot talk, text HOME to 741741 (Crisis Text Line) or call or text 988 any time.
- This unit explains the letter families receive when information is taken in a "data breach" — what it means, and what happens next. It builds on the PII and Cyber Security Awareness units.
The lesson
Part 1. What a data breach is
A data breach is when information an organization was holding — a company, a school, a game, a doctor's office — gets taken, copied, or seen by someone never supposed to have it.
Picture a locked filing cabinet. Sometimes someone picks the lock. Sometimes it was left open by mistake. Sometimes a person who worked there opened it without permission. Either way, information that was supposed to stay inside is now outside — and cannot be taken back.
Notice two things. A breach is about information, not computers breaking — computers can look fine while copies travel anywhere. And a breach is not your fault. Protecting information you trusted an organization with was their job.
Part 2. How a breach happens, in simple shapes
- Someone breaks in. A criminal tricks an employee with a fake message, guesses a weak password, or slips through a part of the system that was never fixed, then copies information.
- Something is left open. A file is set up so anyone can see it, or an email with everyone's information goes to the wrong person. No break-in — the door was open.
- Someone inside misuses it. A worker takes information they had no job reason to touch.
- A device is lost or stolen. A laptop or drive with information disappears.
Whichever way it happens, the organization must find out what happened, close the opening, and tell the people involved. That telling is Part 3.
Part 3. The breach letter — what it means when one arrives
When a breach involves certain personal information, Massachusetts law requires the organization to send notice — to state officials and to the people affected. So a letter arrives saying the organization "experienced a data security incident," naming what information was involved, and offering steps or services.
Read it with a parent or caregiver, and look for the most important line: what information was involved. A name with an email address is one level of problem. A name with a birth date, an ID number, or health information is far more serious — those are the powerful pieces from the PII unit, the ones that do not expire and can be used to pretend to be you.
Two warnings. First, fake breach letters exist — criminals imitate them, hoping you will click a link or call a fake number in a panic. Reach the organization through its real website or a number you already have, never only through the letter. Second, the letter cannot tell you whether your information has been misused yet — only that it was in the group taken. What happens next is Part 4.
Part 4. What your family does — and your part in it
Adults run most of these steps, but understand every one — the information is yours:
- Read and check the letter together (Part 3), and keep it safe. It is a document, not junk mail.
- Watch the accounts. Adults check statements carefully for months. Charges nobody recognizes — even tiny ones — get reported.
- Lock the credit file. Adults can place a security freeze, stopping new accounts from being opened in a name. For children, a parent can ask about a protected freeze for a minor — children's information is targeted because nobody checks it for years.
- Change passwords on accounts connected to the breach, make each one different, and turn on two-factor authentication.
- Be extra suspicious afterward. Fake "breach support" messages often follow a breach. Stop, do not click, verify with an adult.
Your own jobs: tell a parent or caregiver immediately if a breach letter is addressed to you; never answer one by yourself; and if anything strange appears — an account you did not make, a bill with your name — bring it to an adult the same day. Strange paperwork is a smoke alarm, never something to hide.
Part 5. Your rights, and who to tell
You have rights in this, even as a young person: the right to the notice itself, to ask what information was involved and what the organization is doing, and to the protective steps the letter describes — including, in Massachusetts, being told how to place a free security freeze.
And the oldest rule in this school still runs everything: tell a trusted adult, and keep telling until an adult acts. A letter in your backpack helps nobody; read together, it starts every protection in Part 4. If a breach message frightens you, call 911 in danger, text HOME to 741741, or call or text 988.
Words to know — Data Breaches
- Data breach — when information an organization held is taken, copied, or seen by someone never supposed to have it.
- Breach notification — the notice an organization must send to officials and affected people after a breach.
- Security freeze — a free lock on a credit file so new accounts cannot be opened in that name until lifted.
- Personally identifiable information (PII) — information that can identify one specific person, alone or combined.
- Sensitive personal information — identifying information whose misuse can do serious harm, such as ID numbers and birth dates.
- Trusted adult — an adult who believes you, does not hurt you, and will act to help you stay safe.
- Two-factor authentication — a second proof of identity after the password, such as a code on your own device.
- Phishing — a fake message impersonating a real organization to trick you into revealing information.
Myths vs facts — Data Breaches
- Myth: A breach letter means it is too late. Fact: The letter starts the protection. Freezes, password changes, and watching accounts all work after a breach.
- Myth: A big company's breach has nothing to do with me. Fact: If your information was in their files, it does. Size does not change whose name and birth date were taken.
- Myth: The letter's links are the fastest safe way to respond. Fact: Fake letters copy real ones. Reach the organization through its real website or a trusted number.
- Myth: Kids need not worry because kids have no credit. Fact: A child's unused information is valuable exactly because no one checks it for years. Families can ask about a protected freeze for a minor.
- Myth: A breach letter is junk mail. Fact: It is a legal notice. Keep it and read it with an adult.
Think it through — Data Breaches
The situation: A letter to Ana's mother says the billing company for Ana's dentist had a data breach; the information involved included names, birth dates, and health insurance details — including Ana's, age 11. Ana reads it, panics, wonders if she did something wrong, and thinks about putting it back and saying nothing.
Walk it through: (1) Fault first (Part 1): Ana did nothing wrong; protecting the information was the billing company's job. (2) Read the key line (Part 3): birth dates and health insurance details are the serious pieces — this letter matters. (3) The family's steps (Part 4): keep the letter; verify it through the dentist's real number; watch insurance paperwork for care Ana never received; change the portal password to a unique one with two-factor authentication; ask about a protected freeze for a minor. (4) Ana's part (Part 5): she already did it — she brought the letter to an adult.
Cases & codes to study — Data Breaches
The law itself — read the real words
- Mass. Gen. Laws ch. 93H, § 3 (Mass. Gen. Laws) — requires organizations to notify state officials and affected residents without unreasonable delay when personal information is breached; the resident's letter must explain the right to a police report and how to request a free security freeze. Read it: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3
- 45 C.F.R. §§ 164.400–414 (Code of Federal Regulations) — the health breach notification rules. Read it: https://www.ecfr.gov/api/renderer/v1/content/enhanced/2024-04-10/title-45?subtitle=A&subchapter=C&part=164
Where to read the real thing, free: Massachusetts law at malegislature.gov (https://malegislature.gov); federal regulations at ecfr.gov (https://www.ecfr.gov).
Try this — Data Breaches
- ☐ I can explain a data breach in one sentence without using the word "hacked."
- ☐ I know the first move when a breach letter arrives: read it with a parent or caregiver, and keep it.
- ☐ I know to reach an organization through its real website or a trusted number — never only through the letter.
- ☐ I know children's information needs protection too, and that a parent can ask about a protected freeze for a minor.
Resources to keep — Data Breaches
- 911 — in danger now.
- 988 (call or text) — support any time.
- Crisis Text Line: text HOME to 741741 — if you would rather type than talk.
- Childhelp: 1-800-422-4453 — help if an adult is pressuring or hurting you.
- mass.gov — Massachusetts breach information for families.
What you earned / what's next — Data Breaches
✅ Data Breaches complete (quiz score 80% or higher): You can say what a data breach is, name the ways one happens, read a breach letter for its key line, work your family's response steps, and state who to tell.
Your certificate
Minister Destiny Testimony Schools Certificate of Completion — Data Breaches
This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan
Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)
Date completed: ______________
Congratulations. A frightening letter is now a readable one. You know what it means, what your family does next, and that none of it was your fault. — Minister Destiny Marie Morgan
This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone.
What's next: Return to the Topic Library for your next Year 1 Foundations unit.
Sources
- CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for security basics.
- Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for breach and privacy concepts.
- Report a data breach — Mass.gov (https://www.mass.gov/info-details/report-a-data-breach) — the notification law summarized.
- Chapter 93H § 3 (Mass. Gen. Laws) — the Massachusetts duty to report a known security breach and what a resident's notice must contain.
- Part 164, §§ 164.400–414 (Code of Federal Regulations) — HIPAA breach notification duties for unsecured protected health information.
Your Progress — On Your Device Only
- Learning outcomes: On completing this unit, the student can:
- define a data breach and describe the common ways one happens;
- read a breach letter, identify what information was involved, and explain why it must be verified through the organization's real channels;
- list the steps a family takes after a breach, including a security freeze and a protected freeze for a minor;
- state who to tell when a breach letter or strange paperwork arrives.
- Study time: Approximately 45 minutes — an estimate covering reading, activities, and the test. Students move at their own pace.
- Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved only in your own browser on this device, and retakes are allowed.
- Level: Topic Library — Year 1 (Foundations) · Youth school · working rank on completion path: Freshman → Sophomore.
- Version: Version 1.0 — October 2026.
Minister Destiny Testimony Schools — Youth. Educational information only, not legal advice. Help lines: 911 · 988 (call or text) · Crisis Text Line (text HOME to 741741) · Childhelp 1-800-422-4453.