Education expertise big PowerSchool has informed clients that it skilled a “cybersecurity incident” that allowed hackers to compromise the non-public knowledge of scholars and academics in Ok-12 college districts throughout the United States.
The California-based PowerSchool, which was acquired by Bain Capital for $5.6 billion in 2024, is the most important supplier of cloud-based schooling software program for Ok-12 schooling within the U.S., serving greater than 75% of scholars in North America, in accordance with the corporate’s web site. PowerSchool says its software program is utilized by over 16,000 clients to assist greater than 50 million college students within the United States.
In a letter despatched to affected clients on Tuesday and printed in a neighborhood information report, PowerSchool stated hackers efficiently breached its EnergySource buyer assist portal on December 28, permitting additional entry to the corporate’s college info system, PowerSchool SIS, which faculties use to handle scholar information, grades, attendance, and enrollment. The letter stated the corporate’s investigation discovered the hackers gained entry “utilizing a compromised credential.”
PowerSchool has not stated what kinds of knowledge have been accessed through the incident or what number of people are affected by the breach, and neither PowerSchool nor Bain Capital have responded to TechCrunch’s questions.
The nature of the cyberattack stays unknown. Bleeping Computer studies that in an FAQ despatched to affected customers, PowerSchool stated it didn’t expertise a ransomware assault, however that the corporate was extorted into paying a monetary sum to stop the hackers from leaking the stolen knowledge. PowerSchool informed the publication that names and addresses have been uncovered within the breach, however that the knowledge might also embody Social Security numbers, medical info, grades, and different personally identifiable info. PowerSchool didn’t say how a lot the corporate paid.
PowerSchool was sued by class motion in November 2024, which alleges the corporate illegally sells scholar knowledge with out consent for business achieve. According to the lawsuit, the corporate’s troves of scholar knowledge totals some “345 terabytes of information collected from 440 college districts.”
“PowerSchool collects this extremely delicate info underneath the guise of academic assist, however the truth is collects it for its personal business achieve,” whereas hiding behind “opaque phrases of service such that nobody can perceive,” the lawsuit alleges.
