PowerSchool's SIS Incident Meets the Laptop in a Student's Backpack
Student records were taken through a support portal. The Chromebook or laptop a district issued is a second place those records can sit.
PowerSchool's notice says that on December 28, 2024 the company became aware of unauthorized exfiltration of personal information from PowerSchool Student Information System environments through its PowerSource customer support portal. The incident was not described as ransomware. PowerSchool said operations continued and that the information taken varied by school and by person.
For involved individuals, PowerSchool said the data could include one or more of name, contact information, date of birth, limited medical alert information, Social Insurance or Social Security number, and other related information. The company offered identity protection, and credit monitoring for those who had reached the age of majority. It also said it was not aware, at the time of the notice, of identity theft attributable to the incident.
A district still owns the devices
A student information system is the vendor's environment. A cart of laptops is the district's. Teachers download class lists. Nurses record alerts. A laptop left on a bus still has a local cache even when the vendor incident is "contained." Remote wipe belongs in the district's response next to the letter PowerSchool sends families.
Spearstone's MDM policy examples are written for this kind of fleet: employees, contractors, and, here, staff who use school-issued hardware. DriveStrike adds the action at the end of the policy, which is wipe, lock, and locate. It does not replace the vendor's forensic work on PowerSource.
Questions for the next cabinet meeting
- Which schools in your system were told they were involved, and which data fields applied?
- Can you wipe a staff laptop the day it is reported missing, including one that is off campus?
- Are medical-alert fields ever saved to teacher devices? If yes, those devices are in scope.
Contact Spearstone or enroll a pilot fleet in DriveStrike before the next cart leaves the building.
Keep reading
- The Change Healthcare Estimate Moved to About 190 Million People
- The First Hour After a Laptop Goes Missing
Questions worth answering directly
When did PowerSchool say it learned of the incident?
December 28, 2024. The company said data was exfiltrated from SIS environments through the PowerSource support portal, and that affected fields varied by customer and person.
Did PowerSchool publish one national student total in that notice?
The public notice describes categories of people and data. It does not give a single nationwide student count. Do not invent one in a board slide.