PowerSchool has been hacked.
The company, whose software WSSD utilizes for many different purposes including grades and Schoology, discovered a data breach that could put students’ personal information at risk in some districts that use PowerSchool.
The data could include names, grades, grade levels, and addresses of current and former students. Parent and guardian names and addresses could be compromised as well.
According to Interim Superintendent Dr. James Scanlon, WSSD was one of the districts impacted by the data breach. Scanlon announced the leak in an email to staff and parents on January 9, informing them of the breach.
“We certainly understand that this is private information that we would not want someone to have, and that any cyber breach is upsetting and concerning,” Scanlon stated in the email. “Both cyber and physical security are priorities that we continue to focus on. We are working with PowerSchool to provide any additional information as it becomes available.”
According to a letter the company sent to a Georgia school district published in a local newspaper, hackers gained access to customer data through PowerSource, one of the company’s customer support portals.
“While we are unaware of and do not expect any actual or attempted misuse of personal information or any financial harm to impacted individuals as a result of this incident, PowerSchool will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations,” the letter stated.
“The particular information compromised will vary by impacted customer. We anticipate that only a subset of impacted customers will have notification obligations.”
Scanlon assured the community that social security numbers and passwords were not part of the breach and could not be accessed. PowerSchool’s Student Information System product, which Strath Haven uses for grades and scheduling, was the only product affected.
“PowerSchool seems to believe that anything that was taken is destroyed. That’s what they’re telling us, and until we hear otherwise, that’s about all we know at this point,” Scanlon said.
The scale of the breach remains unknown, however, and may vary from district to district. Menlo Park City School District in California reported that student and staff data dating back to 2009 was accessed.
Toronto District School Board, which serves the largest district in Canada with some 240,000 students, said student data dating back to 1985 had been compromised. Lower Merion and Haverford were affected by the breach as well.
In North Carolina, 312,000 teachers’ social security numbers were exposed by the breach.
PowerSchool representatives told Technology Director AJ Cetroni that the data was unlikely to be made public.
“According to PowerSchool, they’ve taken all the appropriate steps to prevent the data from being authorized moving forward, and that they have been told that the information that was secured was deleted and that they don’t believe that it’ll be replicated moving forward,” Cetroni said.
Some students were disconcerted by the breach, particularly addressing data that may have been part of the compromised student information.
“I don’t want some dude pulling up to my house,” sophomore Jackson Bloom said.
Others saw the breach as another reason for moving away from Schoology, a PowerSchool product that WSSD switched to last year from Google Classroom.
“I would say [the breach] is really bad and we should just go back to Google Classroom,” sophomore Adam Hardy said. “There’s really no point in the switch. I think we should switch back, because all the [assistant] superintendent did, [before] they left, was switch us to Schoology, and then they left.
Former Assistant Superintendent Dr. James Conley spearheaded the selection of Schoology as a new learning management system for the district. Conley exited the district in June after two years in his role to serve as Assistant Superintendent in the West Chester Area School District.
Others cited the data breach as a reason to question the investment in PowerSchool products.
“Our school pays a lot of money, so [PowerSchool] should do better,” senior Ian Cheshire said. “We pay PowerSchool too much money on Schoology that is wasted. Not too concerned personally, because it wasn’t like social security numbers and stuff, but it is concerning that the school would do that and not have a reaction against PowerSchool to make sure this doesn’t happen again.”
Cetroni sees the data breaches as a spur for WSSD’s evolving cybersecurity procedures, even though the district was not responsible for the breach in this case.
“I think for the district, our cyber security procedures are always changing to match any kind of technical change in the world,” Cetroni said. “As far as this incident in particular, it was nothing against any procedures or policies that were internal. It was on PowerSchool’s side, so there was nothing WSSD credential-wise that was compromised.”
