The largest education data breach in history was not an attack on a school. It was an attack on a vendor.