School Software Provider is the Latest Target of Major Hack of Personal Data

(Photo illustration by Seksan Mongkhonkhamsao/Getty Images via the North Dakota Monitor)

(North Dakota Monitor) – The sensitive data of millions of American adults and children have been compromised after hackers targeted California-based education software company PowerSchool, the company confirmed.

The breach happened at the end of December, and new information confirmed by TechCrunch says that hackers were able to access student addresses, Social Security numbers, grades and medical information on the platform, which schools use for student records, grades, attendance and enrollment.

The names, phone numbers and emails of parents and guardians were also potentially compromised, the company said. Hackers were able to use a stolen credential, or login, to access the internal customer support portal, the company said. PowerSchool currently has 16,000 customers, and is used by more than 50 million students across North America, the company confirmed. North Dakota K-12 schools use PowerSchool and were affected by the cyber breach, the North Dakota Information Technology Department confirmed.

The incident is the latest large-scale data breach in the U.S., as year after year, the number of cybercrimes continues to rise. The FBI’s Internet Crime Complaint Center recorded 880,418 complaints in 2023, a 10% increase from the complaints registered the year prior, and nearly double the number of crimes reported in 2019. The agency estimates potential monetary losses due to cybercrime since 2019 to be $37.4 billion.

PowerSchool’s breach is an example of how cyber criminals profit — the company said it was extorted into paying a sum to prevent hackers from leaking the stolen data, though it did not say how much.

The hackers’ method of using legitimate credentials to access the internal software is much more common than you might think, said Rob Scott, Dallas-based managing partner of technology law firm Scott & Scott LLP.

When people think about hacking, they likely picture automated attacks that pass through logins and passwords, he said.