FlagThis

PowerSchool, a major education software provider, has suffered a significant data breach, with hackers claiming to have stolen the personal information of 62.4 million students and 9.5 million teachers. The breach occurred after attackers gained access to the company's PowerSource customer support portal using compromised credentials. This access allowed them to download sensitive data from school districts in the US and Canada, including names, contact information, dates of birth, medical information, and in some cases, Social Security numbers, impacting potentially millions of individuals. The Toronto District School Board, the largest in Canada, was heavily affected, with over 1.48 million student records and 90,000 teacher records exfiltrated.

PowerSchool has reportedly engaged with CyberSteward to negotiate with the hackers and prevent the public release of the stolen data, with one affected school district suggesting that PowerSchool paid a ransom. While PowerSchool is working with CrowdStrike to produce a forensic report on the incident, it has also stated that no Social Security Numbers had been breached. The company has committed to offering free identity protection services to all those affected, although the release of a full forensic report, initially planned for January 17, has been delayed. The breach highlights serious vulnerabilities in the security of educational institutions and the need for stronger protective measures.

ImgSrc: www.bleepstatic.com

References:

• Latest from TechRadar - PowerSchool breach worse than thought, company says 'all' student and teacher data accessed - 11d
• techcrunch.com - Malware stole internal PowerSchool passwords from engineer’s hacked computer - 11d
• Dataconomy - PowerSchool data breach exposed student data from 1985 to 2024 - 6d
• oodaloop.com - Students, Educators Impacted by PowerSchool Data Breach - 6d
• TechCrunch - Toronto school district says 40 years of student data stolen in PowerSchool breach - 6d
• www.bleepingcomputer.com - The PowerSchool hacker claims that they stole personal data of 62.4M students and 9.5M teachers; in a private customer FAQ, PowerSchool said it paid a ransom (Lawrence Abrams/BleepingComputer) - 6d
• CISO2CISO.COM & CYBER SECURITY GROUP - Millions Impacted by PowerSchool Data Breach – Source: www.securityweek.com - 5d
• SCM feed for Risk Assessments/Management - Over 70M purportedly compromised in PowerSchool hack - 5d
• ciso2ciso.com - Millions Impacted by PowerSchool Data Breach - 5d

Classification:

• HashTags: PowerSchool DataBreach StudentData
• Company: PowerSchool
• Target: Students and Teachers
• Product: PowerSchool
• Feature: Data Breach
• Type: DataBreach
• Severity: Major