District IT director says PowerSchool breach exposed student and staff tables; no student SSNs found

Director of educational technology Mr. Knox told the Campbell County School District #1 Board of Trustees on Jan. 13 that the district learned on Jan. 7 that its student information vendor, PowerSchool, had experienced a security breach during the holiday break that allowed an attacker to export district data from PowerSchool.

The district’s briefing to the board said the breach occurred around Dec. 22 and that the attacker used credentials to access PowerSchool’s support site and then the PowerSchool systems. "Those credentials were used to get into PowerSchool, and they exported from two of our hundreds of tables, the student table and the teacher table," Mr. Knox said.

Why it matters: the student table holds basic identity and contact fields the district shares with state and third‑party partners; the teacher table holds staff contact information. Mr. Knox told trustees he downloaded both exported files for review and that the student file contained records for more than 39,000 students while the staff file contained about 8,800 staff records. "When we got to things like social security numbers, of the 39,000 plus students, not one of them had a social security number in there," he said. "We had done that over a decade ago as a safety issue. In the teacher file, the only thing that was of a concern for us other than their names was their home phone number."

What was in the exported fields: district staff flagged contact information, demographic fields, and in‑system alert fields used by teachers (examples cited were medical alerts such as asthma or allergies, family/guardian pickup restrictions, and disciplinary alerts used for probation/parole coordination). Mr. Knox said those alert fields do not contain detailed medical records, which are kept in a separate system.

The district response and review: trustees were told the district immediately examined its internal systems, met with PowerSchool for multiple briefings, documented vendor presentations and correspondences, and involved the Wyoming Department of Education and Wyoming Homeland Security. Mr. Knox said the district posted a press release and notified staff and is prepared to provide individual records to families if requested.

On staff identity protection: board member Miss Brenner asked what the district was doing for the four staff members whose social security numbers were present in the exported file. Mr. Knox said the district has successfully contacted three of the four and is trying to reach the fourth; the district is evaluating vendor‑provided protections and will procure additional identity‑protection services if the vendor’s offering is insufficient.

Vendor actions and oversight: Mr. Knox told the board that PowerSchool said it has performed internal remediation, tightened security features and engaged an outside firm to audit its systems. He said the district has limited external connections to PowerSchool pending further verification and that the district will only re‑enable connections once it is satisfied they are secure.

Board and district follow‑up: the superintendent addressed insurance and cyberresponse support, saying the district’s cyber insurance carrier and assigned cyber response team are working with the district. Trustees asked about why long‑retained data remains in the vendor system; Mr. Knox explained that while student records can be deleted, students with multi‑year histories are connected across many PowerSchool tables (courses, grades, attendance, discipline), making wholesale deletion across hundreds of tables a complex, multi‑month task.

What the district said it cannot confirm: Mr. Knox said the district is still awaiting additional information and support from state agencies and the vendor; he also said there had been no reports from families to date requesting remediation.

Next steps noted by staff included continued review with state and federal partners, direct outreach to impacted staff, and written documentation of the vendor briefings and audits.