[American_Centurion]

If Google's spider can effectively breach password protected web sites I would love to have a copy of that.

But it can't. Whatever linked to the page with the sensitive info is how google got there. If it was truly a login/password protected link, google's spider couldn't read it. I would suspect the school is either lying or someone else has posted a link to that page with login and password in the link URL. If the latter is the case, then the school is still wrong for having it's website poorly configured.

Has to be the school's fault, but don't expect them to take the blame, they NEVER do.

[6SJ7]

I'm betting the school had a password protected page, but failed to password protect the pages behind that page which contained sensitive info. The student's site must have linked directly to a non-password protected page. Poor website management.

If the school does not want Google searching their pages, they need to add code to the site to instruct the Google web spiders to skip the site.

[Mr. K]

You nailed it- if they put the info on unsecure web pages THEY are at fault, not google.