After a data breach, a school posts a short apology but gives no details about what data was affected or how students can protect themselves. What accountability step is missing?