Attackers obtained employee Social Security numbers and financial information, but school leaders are still evaluating the extent of the attack.