Most firms are subject to data breaches in today’s cybersecurity sensitive environment. This paper seeks to answer the question, “How do organizations in the educational sector communicate data breaches?”. Situational Crisis Communication Theory (SCCT) was employed as the theoretical lens to review 30 data breach letters sent from the affected institutions to their respective legal authority. A thematic coding approach was applied in analyzing the breach letters to better understand responses in each of the crisis. Following SCCT, institutions were grouped into three clusters, each cluster having been identified with primary and secondary responses, and rewards. The cluster with the largest number of institutions was the victim cluster, and most institutions followed a deny crisis strategy, using a scapegoat as the main tactic.