FARO stands for Frontline Record of Online Harms. Technology-related harm usually reaches the public one case at a time: a school in one country, a family in another, each easy to treat as an exception. This directory puts those cases side by side to help grassroots actors see where others face the same issues they do, and to help governments and regulators see the bigger picture of the harms occurring. The directory describes what its records contain. It does not measure how often these harms occur, and a country with few records may simply have little published about it.
How to use this directory: Topics are filterable for FARO reports that have already been created based on these incidents. The harms and response patterns shown are those featured there. To see the incidents used in a country-specific report, choose that country under Country report. Pick a pattern or evidence type to see on the map which countries have matching records. Click a country on the map or in the list to see its records below. Use the filter to search for keywords or specific sources.
Shaded countries have at least one record. Choose a pattern to see where it appears.
At least one matching recordNo matching recordSelected country
Shading shows only that a country has at least one record in this directory that matches your selection, and every shaded country looks the same on purpose. It says nothing about how often these harms occur there. Pattern filters only cover records classified so far, and small countries are easy to miss on a map, so use the list as well.
Data Breach of Spanish School Extranet Database via SQL Injection
On January 26, 2019, an unauthorized attacker exploited a SQL injection vulnerability in the website of a school in Spain. The attacker gained unauthorized access to the website's user database and compromised the personal details of 1,555 registered extranet users, including parents and staff members. The exposed personal data included names, national ID (DNI) numbers, cooperative member numbers, email addresses, and encrypted passwords.
Data Exposure of School Students via Chromebooks and G Suite in Denmark
Public school students in a municipality in Denmark had their personal information, including full names, schools, and grades, publicly exposed on YouTube and Gmail due to the municipality's misconfiguration of school-issued Chromebooks and G Suite for Education accounts. In several cases, the real names of students with legally protected identities were exposed instead of anonymous aliases. Additionally, the municipality taped login credentials directly onto some students' laptops, compromising account security and confidentiality.
Data Privacy Lawsuit Filed Against Educational Software Provider on Behalf of K-12 Students
K-12 students filed a class-action lawsuit against educational software provider Renaissance Learning, Inc. The lawsuit alleges that the company's platforms, including Star Assessments and Nearpod, generated, collected, used, and shared students' personal and behavioral data without consent. This unauthorized collection and tracking allegedly violated federal and state wiretapping and privacy laws, resulting in an unlawful invasion of the students' privacy.
Data Worker Left Unable to Pay Child’s Medical Bills After Platform Account Shutdown and Payment Freeze
A male freelance data worker in Kenya lost access to his accumulated earnings when his account was permanently closed by his crowdsourcing platform and his funds were frozen by the platform's associated payment processor. Consequently, he was left with no funds to pay for his sick child's medical bills.
Data Worker Loses Savings for Newborn After Platform Account Shutdown and Payment Freeze
A female freelance data worker in Kenya had her earnings taken away when her crowdsourcing platform closed her account and its connected payment processor froze her funds. This loss of income completely wiped out the savings she had been actively building up to support her newborn baby.
Data Worker Unable to Afford Rent After Platform Account Shutdown and Payment Freeze
A freelance data worker in Kenya lost access to his earnings and had his account permanently closed when the crowdsourcing platform he worked for shut down operations and its associated digital payment processor froze his funds. As a result of this sudden loss of income, he was unable to pay his rent, was forced to seek shelter with a friend, and had to rely on others to survive.
Data workers required to use platform-chosen payment methods, with the locally working option unavailable
Workers were required to use platform-selected payout methods instead of preferred local options.
Source: Data Labelers Association
Date source link verified: 22/10/2026
Gig workers pay locked
Not statedNews article
DataAnnotation.tech Contributor Account Deactivated and Wages Withheld
An educator working as an AI trainer on a data annotation platform had their account deactivated without explanation or warning. As a result of this sudden deactivation, the platform withheld $2,869 in completed work and did not respond to the worker's support inquiries.
Dental Student in Kerala Dies by Suicide Following Harassment and Extortion by Online Loan App
A 22-year-old dental student in Kerala, India, died by suicide after being subjected to mental harassment, threats, and intimidation by operators of an online loan app. The platform's operators used high-pressure recovery tactics regarding a loan of 15,000 rupees at an exorbitant interest rate. The local police subsequently registered a case of extortion and digital harassment against the online loan app.
Designer Performs Extensive Unpaid Labor Under Platform Contest Model
A designer based in Quezon City spent 60 hours working on 12 design contests on a creative freelancing platform. After winning only one contest for $500 and paying the platform's fees, the designer netted $350, resulting in low hourly compensation and significant unpaid work.
Edtech sales executive calls parent using six-year-old child’s name; parent does not know how company obtained details
In January 2022, a mother in Karnataka, India, received a phone call from a Byju's sales executive who identified her by her six-year-old child's name and spoke in the family's local language. The mother expressed that the call was highly distressing and made her worry for her child's safety, noting she had no knowledge of how the company acquired her or her child's personal details.
EdWeek / Common Sense Media: national data on students viewing porn at school
Education Week reported on Common Sense Media's first large-scale, demographically representative survey of US teen pornography use, which found meaningful rates of viewing during the school day and specifically on school-issued devices. The article also cites EdWeek Research Center data on the rapid growth of 1:1 school-issued device programs, particularly accelerated by pandemic-era remote learning, as context for why this exposure pathway has grown. This is a research-synthesis article rather than a single incident, aggregating survey data with practitioner commentary from school technology officers.
Elementary School Student Accesses Explicit Content on School-Issued iPad
A parent reported that her 4th-grade female student accessed explicit content while using a school-issued iPad in a classroom at an elementary school. The parent stated that the devices, intended for lessons, were left accessible enough that a child could reach explicit material without deliberate searching. The school principal responded to the parent's concerns, though the school district's specific remediation steps are not detailed in available coverage.
Employee’s salary payment stuck after wallet account blocked
An adult male employee opened a wallet account to receive his salary, which his company successfully paid. The wallet platform then blocked his account, preventing him from logging in and accessing his salary. Customer support replied only with an automated response.
Explicit adult content projected for several seconds during police consent presentation to high school students
During a police presentation on sexual assault and consent to Grade 10 students at a high school in Quebec, Canada, an incorrect file containing explicit adult content was opened on the officer's laptop and projected, lasting a few seconds according to testimonies cited by police. The school board notified parents and offered support services to students. Police called it an isolated error and said officers would get dedicated pre-configured laptops.
Exposure of Minor Student’s COVID-19 Status via School Electronic Register
A minor male student at a school in Italy had his private medical information regarding a positive COVID-19 test exposed to his classmates and their parents. A teacher at the school sent the notification and the official public health document containing the minor's identity via the school's electronic register. The incident led the student's father to file a formal complaint with the Italian Data Protection Authority (Garante), which subsequently investigated and issued an official warning to the school for unlawful data communication.
Source: Garante per la protezione dei dati personali
Exposure of student council candidates’ national ID numbers on Instagram
Five minor students running for their high school's student council had their full names and national identity card (DNI) numbers exposed online after another student photographed their election ballots and uploaded the image to Instagram. The ballots had been incorrectly generated with the DNI numbers by a regional school management system. The unauthorized post was shared with approximately 250 people before the school intervened and coordinated with the platform to have the image removed.
Exposure of student’s special education and health details on school electronic registry portal
An administrative assistant at a high school in Italy made a selection error on the school's electronic registry portal, accidentally publishing a confidential meeting notice to all parents of a class instead of only the target student's parents. As a result, the female student's sensitive personal and health-related data, including her special education status and references to her Individualized Education Plan (PEI), were exposed to the families of all her classmates for several days. Following an investigation, the Italian Data Protection Authority (Garante Privacy) formally admonished the school for the unauthorized disclosure of health data.
Source: Garante per la protezione dei dati personali
Exposure of Teacher’s Work Schedule and Absence Data on Public School Portal
An adult high school teacher's name, detailed work hours, schedule, and absence records were publicly exposed on a school administration platform without password protection by their employer. The teacher complained that the public availability of their detailed schedule created a safety risk by allowing anyone to know when they would be away from home, potentially exposing them to burglaries. The Danish Data Protection Authority ruled on the complaint, finding that the school's interest in publishing the schedule was legitimate under the applicable data protection laws.
Facial recognition monitoring introduced for school employees
Employees at a First Nations school were subjected to a facial recognition monitoring system. Teachers reported concerns regarding biometric privacy data storage practices and accuracy problems and requested suspension of the system.
Families required to buy a EUR 600 Apple iPad for a digital classroom section at a high school in Italy
Parents, speaking through a parent class representative, objected that they were told two weeks before term ended that staying in the digital classroom section required buying an iPad at about EUR 600, on top of EUR 300 to 400 for books. The school head defended the Apple choice as hard for students to modify during tests, and said families could move to the traditional section or change schools. The article says the school appeared to intend co-funding tablets for students in difficulty.
Family could not opt out of school digital ecosystem without educational penalty
A parent reported inability to opt out of school digital systems without educational consequences. This is a personal interview. Source available to SHIELD.
Source: SHIELD - APS, Italy
Date source link verified: 17/10/2026
Technology in Education
IrelandBlog/personal post
Family unable to use digital textbooks on mandatory school device and pressed to take a loan
A parent reported digital-book codes had already been used and the school pushed a credit-union loan for the required device.
Female High School Student Expelled After Rape Video Goes Viral on Social Media
A 17-year-old female student with learning difficulties was drugged and sexually assaulted by two of her schoolmates, who recorded the act on video. After the video went viral on social media platforms, the school administration expelled the victim along with the perpetrators, causing her severe emotional distress and isolation.
Female student forced to surrender Facebook credentials to school officials
School officials demanded that a female student surrender her Facebook login credentials during a disciplinary matter, forcing her to grant access to her private communications and digital social life. The student filed a lawsuit against the school district, which resulted in a settlement and changes to school policies.
First-Grade Student Experiences Nightmares After Viewing Frightening YouTube Videos on School Tablet
A first-grade student was shown frightening horror-themed videos on YouTube during free choice time in class on a school-issued tablet. As a result of watching the videos, the child developed persistent nightmares, prompting their parent to intervene with the school administration.
Florida, USA – special-education student shown pornography by peers on school iPad
A mother reported that her 11-year-old son, a special-education student, was repeatedly shown pornography on a school iPad by older students during recess over a period of roughly three months in 2015. She said her son was threatened by an older student not to disclose what was happening, and that a school staff member reacted dismissively after he eventually reported it. The family filed a lawsuit against the school district seeking damages, alleging the district failed to adequately supervise students' iPad use and did not respond appropriately once the behavior was reported. The mother stated she believes other students were also exposed to pornography on school-issued iPads.
Each record is a short summary of an incident described in a public source or collected through an interview by SHIELD or its partners. Records are reviewed by people before they appear here. Names and identifying details are removed: where a person appears, a role, age band and gender stand in for the name, and dates and places for minors are generalised. Every record links to its original source and shows the date that link was last checked. Records are classified with shared harm categories. The classification is SHIELD's own, so it can differ from how a source describes the incident.
Using the directory
You are welcome to read, link to and quote individual records with credit to FARO. Please do not copy, scrape or republish the dataset in bulk, or use it to train or test automated systems, without written permission. To ask for permission, use the SHIELD contact form. The original sources keep their own rights, and the link on each record leads to them.
How to cite
SHIELD-APS. Frontline Record of Online Harms (FARO). DIRECTORY-URL. Accessed [date]. To cite a particular selection, use the web address shown after you set the filters.
When you rely on the facts of an incident, cite the original source it links to. When you rely on the classification, the patterns or the country report, cite FARO. Please describe the records as documented incidents and do not present counts or country coverage as how often these harms happen. A country with few records may simply have little published about it.
Corrections and removals
If a record is wrong, a link no longer works, or you are described in a record and want it changed or removed, use the SHIELD contact form and include the title of the record. We review each request and update or remove the record where the request is justified.
Report an incident
Know of a documented incident that belongs here? Send it through the incident form. A public source, such as a news report, a court or regulator decision, or a research publication, helps us verify it quickly. Submissions without a public source are kept anonymous and are not tied to named products or companies. Please leave out the names of children and of anyone who has not agreed to be named. Submissions are reviewed before anything is published, and sending one does not guarantee a record.
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
