PowerSchool theft latest: Decades of Canadian student records, data from 40-plus US states feared stolen
(2025/01/22)
- Reference: 1737507751
- News link: https://www.theregister.co.uk/2025/01/22/powerschool_canada_lawsuits/
- Source link:
Canada's largest school board has revealed that student records dating back to 1985 may have been accessed by miscreants who compromised software provider PowerSchool.
The Toronto District School Board, or TDSB, which serves about 240,000 students across 588 schools in the Toronto area, confirmed Monday that whoever broke into PowerSchool's database would have been able to get their hands on kids' sensitive personal info.
PowerSchool runs a cloud-based student information management system for 18,000-plus education customers that holds records on at least 60 million students worldwide, primarily in North America.
[1]
It [2]revealed earlier this month that crooks gained unauthorized access to its database tables of children and educators in December, saying that a limited "subset" of customers were affected.
[3]
[4]
The California-based developer seems to think any data taken by the thieves has been deleted and was not shared with others, which suggests to us that the biz has either heard directly or indirectly from the fiends. PowerSchool earlier said it did not suffer a ransomware infection; just a straight-up network intrusion.
"We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination," the software maker told customers this month.
[5]
Whoever broke in would have been able to access data includes names, genders, home addresses, phone numbers, dates of birth, and health card numbers. Additionally, for students enrolled since September 1, 2017, the security breach may have exposed some medical details as well as parent, guardian, or caregiver contact information.
"With respect to medical information, if you provided information to your child’s school about your child’s allergies, medical conditions, or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired," [6]wrote Stacey Zucker, interim director of education for the TDSB in a letter this week to the parents.
"PowerSchool has reported that it received confirmation that the data acquired by the unauthorized user was deleted and that the data was not posted online," Zucker added.
[7]Database tables of student, teacher info stolen from PowerSchool in cyberattack
[8]Schools bombarded by nation-state attacks, ransomware gangs, and everyone in between
[9]Cybercriminal devoid of boundaries gets 10-year prison sentence
[10]Datacus extractus: Harry Potter publisher breached without resorting to magic
Canada's not alone in dealing with the fallout of the PowerSchool security breach. Reports indicate that schools in more than 40 US states have also been affected in one way or annother. So far [11]Alabama , [12]Alaska , [13]Arizona , [14]California , [15]Colorado , [16]Connecticut , [17]Delaware , [18]Georgia , [19]Idaho , [20]Illinois , [21]Indiana , [22]Iowa , [23]Kansas , [24]Louisiana , [25]Maine , [26]Maryland , [27]Massachusetts , [28]Michigan , [29]Minnesota , [30]Mississippi , [31]Missouri , [32]Montana , [33]Nebraska , [34]Nevada , [35]New Hampshire , [36]New Jersey , [37]New Mexico , [38]New York , [39]North Carolina , [40]North Dakota , [41]Ohio , [42]Oklahoma , [43]Oregon , [44]Pennsylvania , [45]Rhode Island , [46]South Carolina , [47]Tennessee , [48]Texas , [49]Utah , [50]Vermont , [51]Virginia , [52]Wisconsin , and [53]Wyoming . The British Overseas Territory of Bermuda has also [54]reported problems.
PowerSchool is also facing a flurry of lawsuits, with more than 20 currently filed against the biz from what we can observe from the US court system alone.
[55]
Though the software provider stated the exfiltrated data has now been deleted, we'll have to see if the criminals will keep their word on that front. The Register is keeping an eye on the usual ransomware dark web sites and nothing from PowerSchool has been posted yet. ®
Get our [56]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2025/01/09/powerschool_school_data/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.tdsb.on.ca/home/ctl/Details/mid/43823/itemId/409/20250120143203
[7] https://www.theregister.com/2025/01/09/powerschool_school_data/
[8] https://www.theregister.com/2024/10/13/schools_nationstate_attacks_ransomware/
[9] https://www.theregister.com/2024/11/14/cybercriminal_devoid_of_boundaries_gets/
[10] https://www.theregister.com/2025/01/20/harry_potter_publisher_breach/
[11] https://aldailynews.com/powerschool-hack-exposes-alabama-k-12-data/
[12] https://alaskapublic.org/news/education/2025-01-17/juneau-student-school-staff-information-may-have-been-compromised-in-national-data-breach
[13] https://www.kold.com/video/2025/01/11/southern-arizona-school-districts-respond-massive-powerschool-cyberattack/
[14] https://district.mpcsd.org/departments/technology-home/powerschool-data-breach-faq
[15] https://www.koaa.com/news/covering-colorado/manitou-springs-school-district-14-joins-district-49-in-powerschool-data-breach
[16] https://www.wtnh.com/news/connecticut/several-connecticut-school-districts-informed-of-possible-powerschool-data-breach/
[17] https://1063thebear.iheart.com/content/2025-01-21-delaware-valley-school-district-hit-by-data-breach/
[18] https://www.11alive.com/article/news/state/powerschool-data-hack-georgia-school-districts-impacted/85-aa3133b4-99e1-4366-bc83-697f42c0748d
[19] https://kezj.com/ixp/96/p/idaho-powerschool-data-breach/
[20] https://www.nbcchicago.com/news/local/school-districts-data-breach-powerschool-chicago-illinois/3643182/
[21] https://wibqam.com/2025/01/14/clay-community-school-program-powerschool-was-hacked-in-december/
[22] https://www.msn.com/en-us/public-safety-and-emergencies/health-and-safety-alerts/data-breached-of-software-used-by-hinton-community-school-district/ar-BB1roEEA
[23] https://www.kwch.com/2025/01/08/kansas-schools-among-those-impacted-powerschool-data-breach/
[24] https://www.heraldguide.com/featured/cybersecurity-hack-targets-software-used-by-st-charles-parish-public-schools/
[25] https://www.yahoo.com/news/powerschool-hack-exposes-seacoast-schools-200946358.html
[26] https://www.newsbreak.com/cecil-whig-1591339/3762446141807-nationwide-data-breach-impacts-ccps-school-officials-seeking-further-information
[27] https://www.yahoo.com/news/powerschool-data-breach-potentially-affects-210233051.html
[28] https://wwmt.com/news/local/kalamazoo-paw-paw-schools-data-breach-powerschool-student-information-system-education-community-west-michigan
[29] https://www.mnic.org/apps/news/article/2017477
[30] https://www.fox13memphis.com/news/lafayette-county-schools-vendor-has-data-breached/article_8cc78232-d1fc-11ef-9ee0-e7b477559ca2.html
[31] https://www.yahoo.com/news/missouri-school-powerschool-breached-student-041842979.html
[32] https://www.kulr8.com/bozeman/powerschool-data-breach-impacts-bozeman-public-schools/article_95e5286f-8ecd-5fef-a259-fc42152fe03e.html
[33] https://www.wowt.com/2025/01/10/nebraska-schools-warning-parents-about-powerschool-data-breach-targeting-students-information/
[34] https://www.abc10.com/article/news/local/powerschool-data-breach/103-1b3094e0-f631-4069-921f-0193b17b0e5e
[35] https://www.wmur.com/article/data-breach-new-hampshire-schools-powerschool/63375120
[36] https://www.nj.com/education/2025/01/data-about-nj-students-teachers-stolen-in-nationwide-cyberattack.html
[37] http://www.msn.com/en-us/news/us/belen-consolidated-schools-addresses-possible-data-breach/ar-BB1rc0Th?ocid=BingNewsVerp&apiversion=v2&noservercache=1&domshim=1&renderwebcomponents=1&wcseo=1&batchservertelemetry=1&noservertelemetry=1
[38] https://www.newsbreak.com/news/3755201170165-massapequa-school-district-says-it-was-impacted-by-powerschool-data-breach-involving-student-information
[39] https://www.reflector.com/news/local/local-schools-among-those-affected-by-powerschool-data-breach/article_ecf93006-d431-11ef-9f12-e3c9075d1318.html
[40] https://northdakotamonitor.com/briefs/north-dakota-k-12-schools-affected-by-nationwide-cyber-breach/
[41] https://www.dispatch.com/story/news/local/2025/01/10/westerville-schools-hit-by-powerschool-data-breach-and-other-central-ohio-districts-may-be-affected/77586213007/
[42] https://www.koco.com/article/oklahoma-schools-cybersecurity-breach-hack-powerschool/63425073
[43] https://www.govtech.com/education/k-12/oregon-school-district-also-affected-by-security-breach
[44] https://www.pennlive.com/crime/2025/01/powerschool-data-breach-exposes-info-on-millions-of-students-in-central-pa-nationwide.html
[45] https://turnto10.com/news/local/powerschool-data-breach-rhode-island-school-districts-impacted-jan-9-2024
[46] https://www.wbtw.com/news/grand-strand/horry-county/student-data-from-south-carolina-other-states-accessed-after-powerschool-security-breach-officials-say/
[47] https://www.msn.com/en-us/public-safety-and-emergencies/health-and-safety-alerts/powerschool-data-breach-impacts-local-districts/ar-BB1rp2a0?apiversion=v2&noservercache=1&domshim=1&renderwebcomponents=1&wcseo=1&batchservertelemetry=1&noservertelemetry=1
[48] https://www.cbsnews.com/texas/video/powerschool-data-breach-affects-north-texas-school-districts/
[49] https://www.fox13now.com/news/local-news/northern-utah/utah-school-officials-confirm-several-schools-were-affected-by-powerschool-security-breach
[50] https://vtdigger.org/2025/01/08/nationwide-data-breach-affects-student-staff-information-at-vermont-schools/
[51] https://kiowacountypress.net/content/cybersecurity-breach-affects-virginia-schools-through-powerschool-system
[52] https://doorcountydailynews.com/news/775456
[53] https://www.bighorn1.com/article/1955582
[54] https://www.royalgazette.com/education/news/article/20250110/public-schools-it-provider-suffers-cybersecurity-breach/
[55] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[56] https://whitepapers.theregister.com/
The Toronto District School Board, or TDSB, which serves about 240,000 students across 588 schools in the Toronto area, confirmed Monday that whoever broke into PowerSchool's database would have been able to get their hands on kids' sensitive personal info.
PowerSchool runs a cloud-based student information management system for 18,000-plus education customers that holds records on at least 60 million students worldwide, primarily in North America.
[1]
It [2]revealed earlier this month that crooks gained unauthorized access to its database tables of children and educators in December, saying that a limited "subset" of customers were affected.
[3]
[4]
The California-based developer seems to think any data taken by the thieves has been deleted and was not shared with others, which suggests to us that the biz has either heard directly or indirectly from the fiends. PowerSchool earlier said it did not suffer a ransomware infection; just a straight-up network intrusion.
"We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination," the software maker told customers this month.
[5]
Whoever broke in would have been able to access data includes names, genders, home addresses, phone numbers, dates of birth, and health card numbers. Additionally, for students enrolled since September 1, 2017, the security breach may have exposed some medical details as well as parent, guardian, or caregiver contact information.
"With respect to medical information, if you provided information to your child’s school about your child’s allergies, medical conditions, or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired," [6]wrote Stacey Zucker, interim director of education for the TDSB in a letter this week to the parents.
"PowerSchool has reported that it received confirmation that the data acquired by the unauthorized user was deleted and that the data was not posted online," Zucker added.
[7]Database tables of student, teacher info stolen from PowerSchool in cyberattack
[8]Schools bombarded by nation-state attacks, ransomware gangs, and everyone in between
[9]Cybercriminal devoid of boundaries gets 10-year prison sentence
[10]Datacus extractus: Harry Potter publisher breached without resorting to magic
Canada's not alone in dealing with the fallout of the PowerSchool security breach. Reports indicate that schools in more than 40 US states have also been affected in one way or annother. So far [11]Alabama , [12]Alaska , [13]Arizona , [14]California , [15]Colorado , [16]Connecticut , [17]Delaware , [18]Georgia , [19]Idaho , [20]Illinois , [21]Indiana , [22]Iowa , [23]Kansas , [24]Louisiana , [25]Maine , [26]Maryland , [27]Massachusetts , [28]Michigan , [29]Minnesota , [30]Mississippi , [31]Missouri , [32]Montana , [33]Nebraska , [34]Nevada , [35]New Hampshire , [36]New Jersey , [37]New Mexico , [38]New York , [39]North Carolina , [40]North Dakota , [41]Ohio , [42]Oklahoma , [43]Oregon , [44]Pennsylvania , [45]Rhode Island , [46]South Carolina , [47]Tennessee , [48]Texas , [49]Utah , [50]Vermont , [51]Virginia , [52]Wisconsin , and [53]Wyoming . The British Overseas Territory of Bermuda has also [54]reported problems.
PowerSchool is also facing a flurry of lawsuits, with more than 20 currently filed against the biz from what we can observe from the US court system alone.
[55]
Though the software provider stated the exfiltrated data has now been deleted, we'll have to see if the criminals will keep their word on that front. The Register is keeping an eye on the usual ransomware dark web sites and nothing from PowerSchool has been posted yet. ®
Get our [56]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2025/01/09/powerschool_school_data/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.tdsb.on.ca/home/ctl/Details/mid/43823/itemId/409/20250120143203
[7] https://www.theregister.com/2025/01/09/powerschool_school_data/
[8] https://www.theregister.com/2024/10/13/schools_nationstate_attacks_ransomware/
[9] https://www.theregister.com/2024/11/14/cybercriminal_devoid_of_boundaries_gets/
[10] https://www.theregister.com/2025/01/20/harry_potter_publisher_breach/
[11] https://aldailynews.com/powerschool-hack-exposes-alabama-k-12-data/
[12] https://alaskapublic.org/news/education/2025-01-17/juneau-student-school-staff-information-may-have-been-compromised-in-national-data-breach
[13] https://www.kold.com/video/2025/01/11/southern-arizona-school-districts-respond-massive-powerschool-cyberattack/
[14] https://district.mpcsd.org/departments/technology-home/powerschool-data-breach-faq
[15] https://www.koaa.com/news/covering-colorado/manitou-springs-school-district-14-joins-district-49-in-powerschool-data-breach
[16] https://www.wtnh.com/news/connecticut/several-connecticut-school-districts-informed-of-possible-powerschool-data-breach/
[17] https://1063thebear.iheart.com/content/2025-01-21-delaware-valley-school-district-hit-by-data-breach/
[18] https://www.11alive.com/article/news/state/powerschool-data-hack-georgia-school-districts-impacted/85-aa3133b4-99e1-4366-bc83-697f42c0748d
[19] https://kezj.com/ixp/96/p/idaho-powerschool-data-breach/
[20] https://www.nbcchicago.com/news/local/school-districts-data-breach-powerschool-chicago-illinois/3643182/
[21] https://wibqam.com/2025/01/14/clay-community-school-program-powerschool-was-hacked-in-december/
[22] https://www.msn.com/en-us/public-safety-and-emergencies/health-and-safety-alerts/data-breached-of-software-used-by-hinton-community-school-district/ar-BB1roEEA
[23] https://www.kwch.com/2025/01/08/kansas-schools-among-those-impacted-powerschool-data-breach/
[24] https://www.heraldguide.com/featured/cybersecurity-hack-targets-software-used-by-st-charles-parish-public-schools/
[25] https://www.yahoo.com/news/powerschool-hack-exposes-seacoast-schools-200946358.html
[26] https://www.newsbreak.com/cecil-whig-1591339/3762446141807-nationwide-data-breach-impacts-ccps-school-officials-seeking-further-information
[27] https://www.yahoo.com/news/powerschool-data-breach-potentially-affects-210233051.html
[28] https://wwmt.com/news/local/kalamazoo-paw-paw-schools-data-breach-powerschool-student-information-system-education-community-west-michigan
[29] https://www.mnic.org/apps/news/article/2017477
[30] https://www.fox13memphis.com/news/lafayette-county-schools-vendor-has-data-breached/article_8cc78232-d1fc-11ef-9ee0-e7b477559ca2.html
[31] https://www.yahoo.com/news/missouri-school-powerschool-breached-student-041842979.html
[32] https://www.kulr8.com/bozeman/powerschool-data-breach-impacts-bozeman-public-schools/article_95e5286f-8ecd-5fef-a259-fc42152fe03e.html
[33] https://www.wowt.com/2025/01/10/nebraska-schools-warning-parents-about-powerschool-data-breach-targeting-students-information/
[34] https://www.abc10.com/article/news/local/powerschool-data-breach/103-1b3094e0-f631-4069-921f-0193b17b0e5e
[35] https://www.wmur.com/article/data-breach-new-hampshire-schools-powerschool/63375120
[36] https://www.nj.com/education/2025/01/data-about-nj-students-teachers-stolen-in-nationwide-cyberattack.html
[37] http://www.msn.com/en-us/news/us/belen-consolidated-schools-addresses-possible-data-breach/ar-BB1rc0Th?ocid=BingNewsVerp&apiversion=v2&noservercache=1&domshim=1&renderwebcomponents=1&wcseo=1&batchservertelemetry=1&noservertelemetry=1
[38] https://www.newsbreak.com/news/3755201170165-massapequa-school-district-says-it-was-impacted-by-powerschool-data-breach-involving-student-information
[39] https://www.reflector.com/news/local/local-schools-among-those-affected-by-powerschool-data-breach/article_ecf93006-d431-11ef-9f12-e3c9075d1318.html
[40] https://northdakotamonitor.com/briefs/north-dakota-k-12-schools-affected-by-nationwide-cyber-breach/
[41] https://www.dispatch.com/story/news/local/2025/01/10/westerville-schools-hit-by-powerschool-data-breach-and-other-central-ohio-districts-may-be-affected/77586213007/
[42] https://www.koco.com/article/oklahoma-schools-cybersecurity-breach-hack-powerschool/63425073
[43] https://www.govtech.com/education/k-12/oregon-school-district-also-affected-by-security-breach
[44] https://www.pennlive.com/crime/2025/01/powerschool-data-breach-exposes-info-on-millions-of-students-in-central-pa-nationwide.html
[45] https://turnto10.com/news/local/powerschool-data-breach-rhode-island-school-districts-impacted-jan-9-2024
[46] https://www.wbtw.com/news/grand-strand/horry-county/student-data-from-south-carolina-other-states-accessed-after-powerschool-security-breach-officials-say/
[47] https://www.msn.com/en-us/public-safety-and-emergencies/health-and-safety-alerts/powerschool-data-breach-impacts-local-districts/ar-BB1rp2a0?apiversion=v2&noservercache=1&domshim=1&renderwebcomponents=1&wcseo=1&batchservertelemetry=1&noservertelemetry=1
[48] https://www.cbsnews.com/texas/video/powerschool-data-breach-affects-north-texas-school-districts/
[49] https://www.fox13now.com/news/local-news/northern-utah/utah-school-officials-confirm-several-schools-were-affected-by-powerschool-security-breach
[50] https://vtdigger.org/2025/01/08/nationwide-data-breach-affects-student-staff-information-at-vermont-schools/
[51] https://kiowacountypress.net/content/cybersecurity-breach-affects-virginia-schools-through-powerschool-system
[52] https://doorcountydailynews.com/news/775456
[53] https://www.bighorn1.com/article/1955582
[54] https://www.royalgazette.com/education/news/article/20250110/public-schools-it-provider-suffers-cybersecurity-breach/
[55] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z5B7dReb0I4Tip_FruAS8AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[56] https://whitepapers.theregister.com/
Re: But why
Arthur Daily
Where are the alert /sentinel records, like Aaron Arrdavark that tip of security instantly. It is a good outcome, but Google and Spamazon already know all this and more. I am just waiting for this humanless AI scanning of resumes to be leaked. Add to this unwanted, non-turn-offable AI scanning of emails.
But why
Why would historical data not be air gapped?
Surely a year or so after graduation, the data should be sent to secure off-line storage.
Why must “everything” be stored on the Internet?