Victims of the data breach in PowerSchool claim that hackers stole all historical data of students and teachers.
During the cyber attack in December, a large amount of data on current and past students and faculty was obtained, according to various sources.
Recent cyberattacks have affected several school districts in the United States, with hackers managing to access the entire historical data of students and teachers stored in the PowerSchool student information systems. This ed-tech giant, which supports the academic records of over 50 million students nationwide, suffered a breach in December that compromised its customer service portal due to the use of stolen credentials, exposing extensive personal information of students and teachers from K-12 schools.
While the perpetrator of the attack has not been publicly identified, some affected districts have confirmed that the criminals accessed numerous personal details of both current and former students. A representative from one of these districts stated that all historical information of students and teachers was confirmed to have been compromised, adding that records indicate the access occurred earlier than what PowerSchool had officially stated.
Another district, with around 9,000 students, also reported that access was obtained to demographic data of all teachers and students, encompassing all information since they began using PowerSchool. Despite these incidents, PowerSchool has not provided details on how many of its school clients have been affected. Funse expressed that the lack of basic security measures, such as multi-factor authentication, allowed the hackers to carry out their attack.
When contacted, a PowerSchool representative did not deny the claims made by the districts but declined to elaborate on the security measures implemented, citing internal company policies. While it was confirmed that multi-factor authentication is being used, no further details were provided.
Some districts have begun publicly reporting the repercussions of the PowerSchool data breach on their educational communities. For example, the Menlo Park City School District confirmed that hackers accessed data of all current students and staff, as well as records dating back to the 2009-2010 school year. Meanwhile, PowerSchool is still working to identify the specific individuals whose data may have been compromised.
Educational technology experts, such as Mark Racine from RootED Solutions, have pointed out that the breach could also affect districts that were previously PowerSchool clients, suggesting that the scope of the attack may be much larger than the number of the current 18,000 educational institutions. Some districts are reporting that the number of affected students could be four to ten times greater than the total number of currently enrolled students.
The leaked information includes names, addresses, Social Security numbers, certain medical and academic details, as well as other personal data. For its part, the Rancho Santa Fe School District, one of the first to notify state regulators of the data breach, indicated that teacher credential data was also accessed. While PowerSchool has assured that measures have been taken to prevent the publication of the stolen data, no precise details about these actions or proof that the information has been effectively deleted have been provided.