PowerSchool Confirms Data Breach Affecting Students And Teachers, Pays Ransom To Prevent Student Data Breach
A leading provider of cloud-based software solutions for K-12 schools, PowerSchool has confirmed a cybersecurity breach that compromised the personal data of students and teachers from school districts using its PowerSchool SIS platform. The company disclosed that the incident occurred through unauthorized access to its PowerSource customer support portal.
The breach was first identified on December 28, 2024, when PowerSchool discovered that a threat actor had accessed and exported data using a support tool known as the “export data manager.” The attacker gained access via compromised credentials, enabling them to steal data from PowerSchool SIS databases, including sensitive information stored in the “Students” and “Teachers” tables.
The stolen data varies across affected districts but may include names, addresses, Social Security Numbers (SSNs), grade point averages, medical information, and more. The information may include contact details, SSNs, and teachers’ passwords. PowerSchool clarified that customer tickets, credentials, and forum data were unaffected.
In response to the breach, PowerSchool engaged third-party cybersecurity firm CrowdStrike and initiated a series of mitigation measures. These include rotating passwords for all PowerSource accounts, strengthening password policies, and conducting ongoing dark web monitoring to detect potential data leaks.
Although the breach was not classified as ransomware, PowerSchool admitted to paying a ransom to prevent the stolen data from being released. The company, guided by advisory firm CyberSteward, reported receiving “reasonable assurances” from the threat actor that the data had been deleted. However, as with all data extortion incidents, the guarantee of complete deletion remains uncertain.
PowerSchool emphasized that not all SIS customers were affected and anticipates that only a subset of districts must issue notifications. Impacted school districts receive a communication package, including talking points and FAQs, to help inform teachers and families about the incident. The company offers credit monitoring services to affected adults and identity protection services to minors whose information was exposed.
According to an FAQ shared with affected customers, the breach likely began on December 22, 2024, with data exfiltrated from an IP address associated with a Ukrainian hosting provider. Detailed guides are being developed to help districts determine if they were impacted and what data may have been stolen. One such guide, created by an SIS specialist at the American School of Dubai, advises IT personnel to examine audit logs and mass-data export records for unusual activity linked to a maintenance user named “200A0.”
