Millions of Underage Students Exposed in PowerSchool Data Hack

A December 2024 breach into the PowerSchool Student Information System (SIS) exposed the personal information of 62.4 million students and 9.5 million teachers worldwide, as claimed by the hacker. A recent internal report suggests the hack might have been facilitated by a lack of basic security features.

PowerSchool originally reported the attack on January 7th of this year, disclosing that a malicious actor used stolen log-in credentials to access its customer support portal. Through access to the portal, the hacker was able to download databases containing the personally identifiable information (PII) of both students and teachers from schools using PowerSchool’s software.

Some of the stolen PII potentially contains names, addresses, and even social security numbers (SSNs) and medical information. According to PowerSchool’s own website, the company provides services for over 18 thousand schools in over 90 countries, for education ranging from kindergarten to 12th grade.

As reported by BleepingComputer, a cybersecurity news portal, the hacker who claimed responsibility for the attack reports they stole the data of over 62.4 million students and 9.5 million teachers. A PowerSchool spokesperson told media sources that the number of students whose SSNs were compromised was below 25%. This would still comprise millions of students, not to mention students for whom other PII was affected. Both claims are still to be confirmed.

On its website, PowerSchool stated that not all of its users were affected by the attack, and offered the affected parties two years of free credit monitoring and identity protection services.

BleepingComputer also reports that the hacker allegedly deleted the leaked information after PowerSchool paid an undisclosed amount of money, which would mean the affected parties were subject to a ransomware attack (a leak where hackers hold the stolen information for a ransom).

The company claims it’s “committed to protecting the security and integrity of our applications and regularly reviews and enhances its security policies and practices.” However, an internal memo showed the PowerSchool SIS lacked basic security features, such as two-factor authentication, as reported by NBC News. This allowed the hacker to access the system using the stolen credentials.

Ransomware attacks are especially effective when levied against vulnerable populations, including minors. In December 2024, another two separate ransomware attacks also targeted a chain of US addiction clinics and state benefit recipients for the state of Rhode Island.