Parents, students, and educators across North America are reeling from this year’s largest data breach. Hackers have infiltrated a cloud-based software provider used by K-12 schools, exposing the sensitive information of millions of students and school staff.
PowerSchool, headquartered in Folsom, California, serves 16,000 schools globally and manages data for over 60 million students. On January 7, the company confirmed that attackers had accessed and stolen personal data stored within their Student Information Systems.
The stolen data includes Social Security numbers, medical records, and home addresses. A report from Bleeping Computer revealed a ransom note from the attackers claiming they had stolen the records of 62.4 million students and 9.5 million teachers.
Among those most heavily affected is the Toronto District School Board in Canada, which announced on Monday that the information of all students enrolled from 1985 to 2024 has been exposed, equivalent to 1.4 million students and over 90,000 teachers. This data includes names, dates of birth, health card numbers, home addresses, disciplinary notes, and even residency status. The school board also noted that the scope of the breach varies depending on the enrollment period but has affected every student within that timeframe.
The Menlo Park school district in California has reported severe impacts from the data breach. All current students, staff, and anyone who enrolled or worked from the 2009–2010 school year are affected. This breach involves nearly 10,700 students and many former employees.
PowerSchool stated they have been in contact with the hackers, who claimed they would not publish the data, accompanied by a video allegedly demonstrating the deletion of the data. However, experts warn that such claims are difficult to verify and attackers still retain the ability to upload stolen information to the dark web. Some school districts have included these assurances in their breach notifications despite doubts regarding the attackers’ claims of data deletion.
PowerSchool has not confirmed the number of individuals affected or whether they paid the ransom. However, they have begun offering two years of free credit monitoring to those affected. This breach highlights vulnerabilities in online educational systems. Hackers are not only targeting banks, large corporations, and social media platforms.
According to Techspot
