Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
District notifies community after vendor (PowerSchool) breach; vendor says stolen tables were destroyed
Summary
Bozeman Public Schools told trustees that a PowerSchool intrusion on Dec. 28 exposed student and teacher data tables; the district was notified Jan. 7, provided district‑wide messaging Jan. 9, and said the vendor has provided evidence the extracted data was destroyed and is coordinating monitoring and communications.
Bozeman School District staff briefed trustees on a data security incident involving PowerSchool — the district’s student information system vendor — and the steps being taken to notify families and contain risk.
According to the briefing, PowerSchool reported an intrusion on Dec. 28 that exploited a third‑party maintenance component (PowerSource) and allowed unauthorized access to portions of the student information system. The district said it was notified on Jan. 7 and sent a community communication Jan. 9. District personnel reported they were able to identify exactly which tables and fields were accessed.
District technology staff said the vendor provided video evidence of a process they described as a shredding routine that destroyed the copied tables; the vendor and an incident‑monitoring firm are continuing to monitor for misuse. The district has engaged its insurer and is following its data‑breach protocol, including legal review of vendor communications before external distribution. Staff emphasized that the breach affected PowerSchool’s systems rather than district IT systems, and that multiple Montana districts were affected.
Trustees were briefed on next steps: the district will work with the vendor and insurer on required FERPA‑compliant communications to parents and will provide updates as new information becomes available.
What happens next: District staff said they will review PowerSchool communications for regulatory compliance, coordinate messaging through their insurer and counsel, and continue to monitor vendor updates and external monitoring reports.
