A mandatory app exposed the personal information of students and teachers across the country for over a year.