On Dec 28, PowerSchool became aware of a siphon of sorts, one that had managed to maneuver its way past their security systems into the vault of stored data.
According to the description provided on the PowerSchool website, “PowerSchool provides cloud-based software to empower your educators, administrators, and families to help students learn in a way that’s right for them. (Predictive Enrollment Analytics) makes it much easier to explain the ‘why’ behind boundary changes.” Predictive enrollment analytics are used for a variety of purposes, including predicting which classes a student will take.
Course enrollment is one of the main functions PowerSchool is used for, along with viewing a student’s grades and schedule. PowerSchool can most easily be described as data storage software. PowerSchool is the most used public school educational software in North America, being used in 34 percent of public schools in North America, and in 12 percent of Private Schools. Their leading competitor, FACTS Management Company, is not used in any public schools, but makes up for 40 percent of all private schools.
As for the siphon, it is predicted to have slithered its way into PowerSchool’s data around Dec 19 to Dec 23, but PowerSchool claims to have first become aware of the attack on Dec 28. A little more than a week later, PowerSchool notified school districts of the breach. This is particularly relevant because Morgan and Morgan, one of the law firms working to sue PowerSchool, are claiming that they displayed negligence in relaying the information to victims, and thus may have disabled them from enacting countermeasures such as freezing their credit. Morgan and Morgan also claimed that most of the data leaked was from students who had graduated high school, and PowerSchool was holding onto their information long after it was relevant. The next day, various school districts began to notify victims, and six days later on Jan 13, PowerSchool put out a PSA. The claim states that 60 million victims had some form of identity stolen, ranging from Social Security Numbers (SSNs), name, address, date of birth, academic records and medical history. It is important to note the vast majority of SSNs stolen are from administration and not students. In North Carolina, the decision had already been made to switch to an alternate service, InfinityCampus, for the 2025/26 school year.
The GHFalcon sat down with a Green Hope technology contact, Ms. Karyn Hladik-Brown to discuss the incident. When asked why PowerSchool kept student data after graduation, Ms. Hladik-Brown answered, “You know how some websites like to hold on to data so they can learn how to process it better. Maybe they were using the data to help create a better product, but I don’t really know for sure.” She also added, “The entire thing actually happened after one person got ahold of another person’s credentials and was able to log in.” The perpetrators’ reason for this is unknown.
Overall, this was a major event that recently was said to have victimized more than 70 million people globally. PowerSchool is a predominantly North American software company, with most articles being written about United States and Canadian victims, but the Software is used in more than 90 countries worldwide. PowerSchool does have an international certification, meaning they have passed modern tests made for top of the line software. This data breach has raised questions regarding the reliability of PowerSchool, and has sparked discussions regarding the switch to InfinityCampus.
