- A hack on school software provider PowerChool has put staff and students at risk
- Individual schools are now measured using the same data
- Powerschool paid ransom but the data was not wiped out
The hackers, who hit Powerschool in 2024, are now allegedly targeted at individual schools and blackmailed them for ransom and threaten to release previously stolen students and staff information.
“Powerschool is aware that a threat actor has reached several school district customers in an attempt to extort them by means of data from the previously reported December 2024 event,” the organization confirmed.
Powerschool is a top education software platform with over 17,000 customers spans 90 countries and supports over 50 million students. A Cyberattack in December 2024 led to the personal data of 62 million students and 9 million teachers appointed by attackers, with over 6,500 school districts in the US and Canada affected.
Students at risk
Powerschool paid ransom to the cyber criminals in the hope that they would dry the stolen data, but as these recent events use information that matches what was stolen in the hack in December, it seems clearly that this was not the case.
“It was a difficult decision and one that our leadership team didn’t make easy,” the company said.
“But we thought it was the best opportunity to prevent the data from being published and we felt it was our duty to take this action. As is always the case with these situations, there was a risk that the bad players would not delete the data they stole, despite insurance and evidence provided to us.”
The Exfiltered data includes personally identifiable information such as social security number, names, addresses and even medical information.
As such, the company recommends that anyone affected by the two years of free credit monitoring and identity theft -protection software to mitigate the risks that the stolen information pose.
Powerschool apologized for the threats that the violation constituted and has confirmed that it will continue to work with law enforcement authorities to mitigate the damage and respond to the extortion attempts.
Via Bleeping computer
