Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Security topic
No spam. Unsubscribe anytime.
District notifies families after PowerSchool vendor breach exposed two decades of records
Summary
Superintendent and IT staff told the board that a maintenance account compromise at PowerSchool led to extraction of student and staff directory data and some PII; the district notified parents and is coordinating with state cyber teams.
District technology staff and Superintendent Thomas told the board that PowerSchool — the district’s student information system vendor — experienced a breach affecting a maintenance account that exists on many PowerSchool instances. The district was notified by PowerSchool on Jan. 6 and subsequently found that data were taken beginning Dec. 22, the administration said.
Chief information staff said the extracted data included student and staff directory information (names, addresses, phone numbers, birth dates) and some additional personally identifiable information such as medical alerts recorded in student records. The district said it did not find Social Security numbers in the accessed tables.
Nut graf: District leaders said they moved quickly after notification — engaging the state cybersecurity team, the Wyoming CARES unit and external ETS resources, reviewing files, drafting parent communications and posting notice to staff and community channels. The district advised vigilance against phishing attempts that may use the breached directory data.
IT staff said PowerSchool has represented that the attackers deleted the copied data after receiving payment, and noted that the likely misuse of the data is phishing using accurate names and contact details rather than immediate financial fraud. The district established an email line for concerned parents and posted guidance on phishing awareness; officials said they will continue monitoring and updating the community.
Ending: Board members thanked technology staff; the superintendent said the district followed statutory notification requirements and consulted legal counsel when drafting the parent letter.
