Sounds like typical CYA (Score 1)

Look back over the recent months and you'll notice immediately that the reaction of any government agency when faced with the public finding out they haven't secured something properly isn't that agency coming clean it is that agency immediately calling in law enforcement against the whistle blower. Right now for all we know, and all we'll ever know since they've probably locked down the system, is what the School and the politician who appointed those officials what you to hear. Notice that while they can't name the student because of his age we also haven't see any mention of who screwed up with security?
I was once a resident of the district mentioned and I'm betting that if, big if up there, the whole story comes out we find that the server was set up in such a way that when a student logged on for authorized information the "secure" file was sitting right amid that weeks home work assignments.