HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDEducationEmploymentCredentialsHealth (basic)LocationBehaviorMediumContained

Kamiah Joint School District No. 304

bd_1caf056208d16be0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 7, 2025

Filed

Jan 10, 2025

To disclose

3 days

Affected

Not disclosed

Confidence

65%

Full breach record for Kamiah Joint School District No. 304 →

Kamiah Joint School District No. 304 notified the Idaho Attorney General on January 10, 2025, of a cybersecurity incident involving its PowerSchool Student Information System. An unauthorized party accessed student and teacher data using compromised credentials. Affected data includes SSNs, names, and contact information. The district engaged forensic firms (CyberSteward, CrowdStrike) and negotiated data destruction. Notification was sent to families and staff on January 10, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 3 days

Jan 7, 2025

Discovered

Jan 10, 2025

Filed

vs. sector median

8 wks faster

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Kamiah Joint School District No. 304
norm: kamiah joint school district no 304
Domain: kamiahsd.org

Name: Kamiah Joint School District No. 304
norm: kamiah joint school district no 304
Domain: kamiahsd.org
Industry: Educationllm

Discovered: Jan 7, 2025
Materiality determined: —
Notification sent: Jan 10, 2025
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General’s Office Consumer Protection Division
Third party: via PowerSchool
Initial access: valid_credentials

During the incident: Engaged CyberSteward and CrowdStrike to investigate and respond
Negotiated agreement for the party to destroy stolen data
Notified current employees and student families via email, text message, and app notification
Closed the back channel connection between servers and PowerSchool IT team
Reviewed other on-premise servers housing personal information
Changes made: Reviewing other on-premise servers that house personal information to ensure other such connections are not kept open
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/01/1-10-2025-Kamiah-Joint-School-District-No.-304.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2025
Raw hash: ba3de0ddd924a93733b374dbaba8b05afc5cbf9e6f9a41aa49990a0148e5debd

Reporting entityKamiah Joint School District No. 304

Victim entityKamiah Joint School District No. 304

Incidentdiscovered Jan 7, 2025

Stated responseEngaged CyberSteward and CrowdStrike to investigate and respond

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov