The Glenwood Springs Post Independent reported Sunday the database was kept by a contractor working for the Roaring Fork School District. The database involved 119 students and 60 staff members.
Jeff Gatlin, chief operating officer for the district, says some emails may also have been accessed.
The breach occurred in March and was discovered in July.
Officials say the contractor has switched to a different database platform.