State school staff and student data dating as far back as 2020, including names, email addresses and school locations, were compromised.