PowerSchool Data Breach: Hackers Compromise Complete Historical Records of Students and Teachers

In a significant cybersecurity incident, U.S. school districts have reported that hackers gained access to comprehensive historical data of students and teachers stored in their systems, following a cyberattack on the edtech giant, PowerSchool. This breach has raised serious concerns about data security in educational institutions across the nation.

Details of the PowerSchool Cyberattack

PowerSchool, a leading provider of student information systems used by over 50 million students in the United States, suffered a severe intrusion in December. Hackers exploited compromised credentials to breach the company’s customer support portal, exposing a vast amount of sensitive information.

Extent of Data Compromised

• Accessed data includes historical student and teacher information.
• Both current and former students’ records were compromised.
• Data accessed spans back to the 2009-2010 school year.

Sources from affected districts, who spoke to TechCrunch on condition of anonymity, confirmed that the hackers obtained extensive personal data. One source stated, “In our case, I just confirmed that they got all historical student and teacher data.” This underscores the severity of the breach.

Security Failures and Company Response

PowerSchool has not disclosed the number of school districts impacted by this data breach. However, it has been noted that many districts reported inadequate security measures, including the absence of multi-factor authentication.

Beth Keebler, a spokesperson for PowerSchool, acknowledged the breach but refrained from discussing specific security controls, citing company policies. When pressed for details regarding their security measures, Keebler confirmed the use of multi-factor authentication but offered no specifics.

Public Statements from Affected School Districts

Several school districts have provided updates on the breach’s impact on their communities. For example, the Menlo Park City School District disclosed that hackers accessed data concerning all current students and staff, along with historical data.

Broader Implications of the Breach

Mark Racine, CEO of RootED Solutions, indicated that the ramifications of the breach could extend beyond PowerSchool’s current customers, potentially affecting former clients as well. Reports suggest that some districts estimate the number of affected individuals could be four to ten times greater than their current enrollment.

Types of Data Compromised

The stolen data includes:

• Names and addresses
• Social Security numbers
• Medical information
• Grade information
• Other personally identifiable information

PowerSchool has stated that it is conducting a thorough review of the data involved and is working to identify specific individuals affected by the breach. They also mentioned that the majority of customers likely did not have sensitive information like Social Security numbers compromised.

Next Steps for PowerSchool

In response to the breach, PowerSchool has implemented measures to prevent the stolen data from being disseminated further. However, the specifics of these measures remain undisclosed, raising questions about the effectiveness of their data protection protocols.

If you have more information about the PowerSchool data breach, we encourage you to reach out to us. For secure communication, you can contact Carly Page via Signal at +44 1536 853968 or through email at [email protected].