A recent audit found the state's Education Department was storing sensitive personal data in plaintext format and not updating its software.