Pilfered Data Not Deleted as Promised

Some School Districts Now Being Extorted by Hackers By Gordon Hopkins Despite payment of a ransom and assurances from a software vendor that student information stolen during a breach last year had been destroyed, some schools districts in the U.S. and Canada are being extorted by the same hackers, using the same compromised data.PowerSchool provides the Student Information System (SIS) used by more than 18,000 schools, supporting more than 60 million students, including many local schools districts in Nebraska.On December 28, 2024, PowerSchool became aware of a cybersecurity incident involving what the company called “unauthorized exfiltration of personal information” through a customer support portal, PowerSource. According to PowerSchool, the breach was the result of someone using a “compromised credential.” While the company did not experience any operational disruption, data was compromised.The personal information of both students and educators information has been potentially been impacted, including names, addresses, phone numbers, dates of birth, various ID numbers and, in some cases, social security numbers.Earlier this year, PowerSchool advised schools that they believe all the data that was downloaded had been destroyed. Ryan McDowell, director of IT & SNDLC for ESU5 (Educational Service Unit 5), told FJN in an email on January 21, 2025, “Powerschool has told us that they came to an agreement with the cybercriminals and that the data was destroyed.”Evidence that the data was destroyed was provided to PowerSchool in the form of a video. McDowell wrote, “They did a video chat with them where they used the Linux 'Shred' command, which securely destroys the data. This doesn't mean the cybercriminals didn't copy the data before showing this. Essentially they have to trust the criminals that stole the data in the first place to keep their word that they actually deleted everything.” What Was the Nature of the Deal?At the time, PowerSchool provided no details of the deal made with the hackers. FJN reached out to PowerSchool and asked if any payment was made. PowerSchool neither confirmed nor denied paying anything to those responsible for the data breach but instead referred FJN back to the January 17 statement, “Thank you for reaching out. For the latest information on the cybersecurity incident and all PowerSchool is doing to support those affected, please visit: http://www.powerschool.com/security/sis-incident/.”More recently, however, PowerSchool acknowledged that the company did, indeed, pay a ransom. In an statement issued Wednesday, March 8, PowerSchool wrote, in part, “Any organization facing a ransomware or data extortion attack has a very difficult and considered decision to make during a cyber incident of this nature. In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve. It was a difficult decision, and one which our leadership team did not make lightly. But we thought it was the best option for preventing the data from being made public, and we felt it was our duty to take that action. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”It appears that the data had not been destroyed as promised. The company's statement admits, “PowerSchool is aware that a threat actor has reached out to multiple school district customers in an attempt to extort them using data from the previously reported December 2024 incident. We do not believe this is a new incident, as samples of data match the data previously stolen in December. We have reported this matter to law enforcement both in the United States and in Canada and are working closely with our customers to support them. We sincerely regret these developments – it pains us that our customers are being threatened and re-victimized by bad actors.”The FBI (Federal Bureau of Investigation) advises against paying online ransoms, “Paying a ransom doesn’t guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.” Local SchoolsMore than half of the school districts across Nebraska use PowerSchool as their SIS, including Fairbury Public Schools, Diller Odell Schools, Meridian Public Schools, Thayer Central, Southern District Schools and Wilber-Clatonia.FJN has reached out to those local schools. None have indicated they have been contacted by the threat actors. Thus far, Diller-Odell Public Schools is the only school to say they have received an email from PowerSchool, alerting them to this matter. The email reads, in part, “In light of this, I want to take a moment to remind you all that following the December 2024 incident, PowerSchool also offered and made widely available credit monitoring and identity protection services for a period of two years to students and faculty of our PowerSchool SIS customers, regardless of whether they were individually involved. We encourage you all to take this opportunity to remind your communities that these services are still available.”

Nebraska GOP Supports Trump at Town Halls

County Facing Additional $50,000 In Software Updates

Related Articles

Voters Reject Tri County School Bond

Dead Man in the Ring: Part One

FPS Announces New Head Coach

Ricketts, Fischer Champion Relocating USDA to Nebraska