- Threat actors gained access to the PowerSchool student information system and stole student and teacher data in December 2024
- Several companies confirmed that all data covering as long as they had been using PowerSchool was taken
- The data was allegedly deleted by the hackers
The latest cyber attack on education technology software company PowerSchool appears to be much worse than first thought as several companies came forward to say that all of their data was stolen in the incident.
In late December 2024, an unidentified threat actor used stolen credentials to access its PowerSchool Student Information System (SIS) platform. From there, they were able to use the “export data manager” customer support tool to exfiltrate the “Students” and “Teachers” database tables into a CSV file, which was then stolen.
The information seized in this attack included names and mailing addresses, and in some districts, the threat actors also obtained social security numbers (SSN), personally identifiable information (PII), medical information, and grades.
No ransomware
While PowerSchool declined to say how many schools were affected by the attack, TechCrunch reached out to some and confirmed that the incident was quite devastating.
Two unnamed sources at affected school districts told the publication that the hackers were able to access “a wealth of personal data belonging to both current and former students and teachers.”
One company said the criminals stole all historical student and teacher data, while another added that demographic data for all teachers and students, both active and historical, was grabbed.
Apart from these two organisations, which wished to remain anonymous, others also spoke publicly about the incident, it was further explained. Menlo Park City School District also confirmed historical data theft, Rancho Santa Fe School District filed a data breach notification, and RootED Solutions (an edtech consulting firm from Boston) said the PowerSchool breach also affects school districts that no longer use the service but did at some point.
PowerSchool said that while this was not a ransomware attack, it still paid the attackers to have the data deleted.
Via TechCrunch
