Auburn School Committee briefed on PowerSchool breach; district notified families

The Auburn School Committee was briefed Feb. 26 on a December data breach affecting PowerSchool that exposed basic demographic tables for many districts, including Auburn Public Schools.

Technology staff member Peter Robinson told the committee the incident began in December when a compromised PowerSchool support account allowed a malicious actor to access support systems and run a script that copied student and staff demographic tables on Dec. 22. Robinson said the data taken included names, addresses, phone numbers and parent information but did not include grades, individualized education program records, nurse or medication records, or Social Security numbers. "This is basically demographic information," Robinson said.

The district and Robinson emphasized why the breach matters to families and how the district responded. Robinson said Auburn immediately turned off remote support access that PowerSchool had used by default and that the district notified current families and staff by phone and email rather than waiting for PowerSchool to handle notifications. "We immediately once we had this happen, Dr. Doris and I had a conversation and decided that we needed to go ahead and notify our community straight away," he said.

Robinson outlined steps PowerSchool reported taking to reduce future risk, including requiring employees to use a VPN, enabling two-factor authentication, and changing support access so it is turned off by default and must be enabled only temporarily for a support case. He said PowerSchool engaged a third party called Cyber Steward to broker an agreement with the actor and provided what Robinson described as "assurances and proof" that copied data were deleted; he added that "there is no complete assurance ever in a case like that."

Committee members asked about district-level changes. Robinson said the district has activated multifactor authentication for staff accounts and has disabled persistent remote support access; he also described pursuing staff training funded through a pending state grant. The district plans to use a training platform called KnowBe4 to run simulated phishing emails and interactive follow-ups for staff. "It's just a constant thing," Robinson said of phishing attempts; he described recent incidents in which a staff account was compromised after an employee provided a multifactor code to an attacker.

Board members also questioned student email and training. Robinson said Google for Education accounts are created for students when they enter PowerSchool but that routine email use typically begins in upper elementary grades and that the district encourages digital citizenship training at the classroom level. He said the technology team is small and cannot provide targeted training for every student but expects some phishing-awareness content to be provided through teachers and building technology representatives.

The superintendent, Dr. Sue Doris, and Robinson said Auburn does not store Social Security numbers or other financial information in the affected PowerSchool tables, and they characterized the leaked data as the kind of contact directory information found in many districts' demographic tables.

Committee members did not take formal action on the report; the briefing concluded with a discussion of next steps for training and continuing to harden the district's systems.