PowerSchool hack: missed basic security step resulted in data breach
The hack of PowerSchool appears to be the largest breach of American children’s personal information to date, school officials and cybersecurity experts say.
The hack of a company that helps schools track tens of millions of students appears to be the largest breach of American children’s personal information to date, school officials and cybersecurity experts say.
And a specially commissioned interim cybersecurity audit by cybersecurity company CrowdStrike showed that the company had apparently failed to take basic precautions to protect students’ data, according to a copy exclusively obtained by NBC News and records of internal discussions.
The company, PowerSchool, is best known for its Student Information System (SIS), one of the most widely used education tech programs in the U.S., and one of the breached systems. The SIS software helps school districts keep track of K-12 students, collecting information like their name, school, birthday, address and parent or guardian. Many districts go further and add information like their Social Security number, health concerns or disciplinary records.
Theft of children’s data is regarded as particularly egregious, as they usually have no agency in how it’s protected. It can be difficult to draw a direct line from a particular data breach to a given instance of identity theft, as cybercriminals repeatedly repackage and resell victims’ information. But identity theft cost Americans around $43 billion in 2023, according to a 2024 study by AARP.
“We recognize the significance of this incident and are deeply regretful that it occurred,” Beth Keebler, a PowerSchool spokesperson, said in an emailed statement. “PowerSchool has significantly invested in its cybersecurity program, culture, and talent over the years — this has been a diligent and continuous area of focus and one the Company plans to continue to invest in.”
Rating: 5