A cybersecurity incident is an event that actually or potentially jeopardizes a system or the information it holds. When a student's personal information is disclosed, it can lead to physical, emotional, and financial harm. Organizations are vulnerable to data security risks, including over 17,000 public school districts and approximately 98,000 public schools. As schools and districts increasingly rely on complex information technology systems for teaching, learning, and operating, they are collecting more student data electronically that can put a student's information, including PII, at risk of disclosure. The closure of schools and the sudden transition to distance learning across the country due to the Coronavirus Disease 2019 (COVID-19) pandemic also heightened attention on K-12 cybersecurity. The Government Accountability Office (GAO) was asked to review the security of K-12 students' data. This report examines: (1) what is known about recently reported K-12 cybersecurity incidents that compromised student data; and (2) the characteristics of school districts that experienced these incidents. GAO analyzed data from July 1, 2016 to May 5, 2020 from the Cybersecurity Resource Center (CRC) (the most complete source of information on K12 data breaches). CRC is a nonfederal resource sponsored by an educational technology organization that has tracked reported K-12 cybersecurity incidents since 2016. GAO also analyzed 2016-2019 Department of Education data on school district characteristics (the most recent available), and interviewed experts knowledgeable about cybersecurity.