The following is a message from FinalForms CEO, Clay Burnett, with more information regarding the June 2025 security incident.
I am writing to give you an important update about the cybersecurity incident that affected FinalForms earlier this year. We believe it is important to share this information with you right away so you can take any steps you feel are necessary to support your students and families.
Consistent with our prior communication, the incident occurred when a minor gained unauthorized access to one or more accounts by using compromised, reused credentials from unrelated public breaches. This was not the result of any flaw or vulnerability in the FinalForms system.
What We Have Learned in the Last 24 Hours
FinalForms received new and credible information from federal law enforcement. Contrary to earlier assertions by the individual and his family, we believe the minor in question still has data stolen from school accounts.
There is a credible risk that this information could be used to contact and extort individuals connected to the data.
This new intelligence materially changes our position and necessitates this notification to school districts.
Why We Were Limited in Our Earlier Communications
From the outset, FinalForms has coordinated closely with state and federal law enforcement agencies. At their direction, we were limited in what we could publicly share in order to avoid compromising:
Active investigative efforts
Data-recovery work
Digital-forensics activity
Criminal proceedings involving the individual responsible
Throughout this period, we acted in accordance with law-enforcement guidance, while also pursuing all available civil remedies to support mitigation and recovery.
Why We Are Notifying You Now
Based on the new information just provided to us, we have determined that the potential risk to impacted students is ongoing and now outweighs prior concerns about investigative impact.
Given the credible continuing risk of harm to these students, we believe it is our ethical responsibility to notify you immediately – even over the request of law enforcement to delay notification further.
We are taking this step so that your district can take appropriate precautions and support your community.
Next Steps From FinalForms
Over the next 48 hours, FinalForms will:
Begin sending individual notifications to impacted students and parents/guardians whose data was involved.
These notifications will include details about the categories of data involved and clear reporting avenues recommended by law enforcement and child-safety agencies.
What This Means for Your School or District
Given the nature of the new information, districts should be aware of the potential for:
Unwanted or unsolicited contact directed to individuals connected to the data
Attempts to gather additional personal information
Communications intended to cause concern, confusion, or pressure
We are issuing this notification so you may take the steps you feel are appropriate to protect your students and support your community.
Our Commitment
We know this development is concerning. Please know that FinalForms remains committed to:
Student and family safety
Maximum transparency with partner schools and districts
Compliance with all applicable laws and agreements
Supporting your school or district throughout this process
Working closely with state and federal law enforcement and cybersecurity experts as the situation continues to evolve
If you have questions or need support, please contact our team at:
Thank you for your continued partnership and understanding.
Sincerely,
Clay Burnett
CEO, FinalForms