Student Information System Data Breach

PowerSchool notified our IT Department that we were among PowerSchool’s many worldwide clients whose data may have been accessed during a cybersecurity incident on December 28, 2024 at 3pm,
members of the Technology and Leadership Teams attended a detailed PowerSchool debrief about the data breach.
What happened?
According to PowerSchool, someone used a compromised PowerSchool credential to access data stored in the global Student Information System (SIS). When PowerSchool became aware of the incident on December 28, 2024, they notified law enforcement, locked down the system and engaged the services of CrowdStrike (a cybersecurity company that develops software to
help companies detect and prevent cyberattacks) and Cyber Steward (a professional advisor with experience in negotiating with threat actors).
What data could have been accessed?
Initial information from PowerSchool indicates that information about staff and students may have been accessed for some districts. Information accessed may include contact information, including names, addresses and phone numbers as well as some grade information for students. We do not retain student or staff social security numbers, and no financial information was included in the data breach.
PowerSchool states that they have received “reasonable assurances from the threat actor that the data has been deleted and that no additional copies exist. We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination. We have a video confirming deletion and are actively searching the dark web to confirm.”
What happens next?
PowerSchool has stated that the incident is contained, and they have no evidence of malware or continued unauthorized activity in the PowerSchool environment. They are not experiencing, nor expect to experience, any operational disruption and they continue to provide services as normal to school districts. PowerSchool has stated, “While we are unaware of and do not expect any actual or attempted misuse of personal information or any financial harm to impacted individuals as a result of this incident, PowerSchool will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations.”
We anticipate PowerSchool will be providing us with resources and additional information and we will share all relevant information as it becomes available to us. While PowerSchool is responsible for this incident and its impact, we are committed to protecting our student, staff and family data and will continue to communicate with transparency about this incident.