Parents, students, and educators across North America are reeling from the biggest data breach of the year so far. Hackers broke into a cloud-based software provider used by K-12 schools, exposing sensitive information belonging to millions of students and school staff.
PowerSchool, based in Folsom, California, serves 16,000 schools worldwide and manages data for more than 60 million students. On January 7, the company confirmed that the attackers had accessed and stolen personal data stored in its Student Information System.
The stolen data includes Social Security numbers, medical records, and home addresses. A report from Bleeping Computer revealed an extortion note from the attackers claiming they had stolen the records of 62.4 million students and 9.5 million teachers.
Among the hardest hit is the Toronto District School Board in Canada, which announced on Monday that the information of every student enrolled between 1985 and 2024 was exposed, amounting to 1.4 million students and more than 90,000 teachers. The data includes names, dates of birth, health card numbers, home addresses, disciplinary notes, and even residency status. The district also noted that the scope of the breach varies depending on the enrollment period, but it affected every student in that window.
California's Menlo Park school district has reported serious impacts from the breach. All students and current staff, along with anyone who has enrolled or worked there since the 2009 - 2010 school year, were affected. The breach involves nearly 10,700 students and many former employees.
PowerSchool said it has been in contact with the hackers, who claim they will not release the data and supplied a video that supposedly proves the data was deleted. However, experts warn that such claims are hard to verify and that the attackers could still post the stolen information on the dark web. Some school districts have included these assurances in their breach notifications despite doubts about the attackers' claims of data deletion.
PowerSchool has not confirmed how many individuals were affected or whether it paid a ransom. It has, however, begun offering affected people two years of free credit monitoring. The breach exposes weaknesses in online education systems. Hackers are not just going after banks, large corporations, and social media platforms.
Source: Techspot
