Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
District 5 officials say PowerSchool support account was compromised; no malware detected
Summary
The district’s technology director said an unauthorized party accessed customer data in PowerSchool beginning Dec. 19. The state is leading notification and remediation; the district says student Social Security numbers and the parent portal were not stored in its instance.
The School District 5 director of technology told the board on Jan. 13 that an unauthorized party accessed customer data in the PowerSchool student information system and that the event began Dec. 19, according to district officials. "This was not an encryption event," Director of Technology Jenny Garrus said. "There is no ongoing malicious activity in anyone's PowerSchool environment."
Garrus said PowerSchool informed customers that internal support-account credentials were compromised and that the company moved to contain and remediate the incident. PowerSchool notified districts, held a webinar for customers and engaged outside cyber investigators; Garrus said PowerSchool has hired CrowdStrike and that a forensic report from that firm was expected later in the week.
Garrus said the State Department of Education is coordinating the statewide response under the PowerSchool contract the state holds. The state has contacted the attorney general, the governor's office, the FBI, SLED and the district’s cyber-insurance carrier, Skisbit. "The state is holding PowerSchool accountable for that contract and for this data breach," Garrus said.
District officials told the board they do not store student Social Security numbers in PowerSchool and that the parent portal and financial payment system (RICOR) were not affected. Garrus said the breach involved a threat actor seeking money rather than public dissemination of data, but stressed that monitoring and protective steps remain necessary. "We will continue to monitor the dark web for any of this data," she said.
Superintendent Ross told the board the district will follow state guidance and press PowerSchool for notification and identity-protection measures for affected families. Garrus said the district activated its incident-response plan where applicable and is following guidance from SLED and other state resources. The district also notified families with an initial press release following state direction.
