HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Orleans Southwest Supervisory Union Central Office
bd_08f975227b86e2a8 · schema v1 · pii pii-v1
Full breach record for Orleans Southwest Supervisory Union Central Office →Orleans Southwest Supervisory Union (OSSU) notified consumers of a data breach involving its third-party vendor, PowerSchool. Between Dec 19-28, 2024, an unknown actor accessed and downloaded personal information, including names and Social Security numbers, from PowerSchool's systems. OSSU's own systems were not impacted. OSSU initiated an investigation, verified the scope, and is offering 24 months of complimentary identity theft protection and credit monitoring through Experian.
Vermont clock⏱ VT AG >14 bday9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-03-12-orleans-southwest-supervisory-union-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 12, 2025
- Raw hash
- 16f2828ef7c3a5ef3b90b9a04cae7fa1f607630e58a50d2a1ab321530f29f1f3
Reporting entity
- Name
- Orleans Southwest Supervisory Unionnorm: orleans southwest supervisory union
Victim entity
- Name
- Orleans Southwest Supervisory Union Central Officenorm: orleans southwest supervisory union central office
- Domain
- ossu.org
Incident
- Discovered
- Jan 7, 2025
- Materiality determined
- —
- Notification sent
- Mar 12, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 9 weeks(64 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.