PowerSchool
bd_56171406702909c2 · schema v1 · pii pii-v1
Full breach record for PowerSchool →PowerSchool notified the Idaho Attorney General on January 27, 2025, of a cybersecurity incident occurring between December 19 and 28, 2024. Unauthorized actors exfiltrated personal information from the PowerSchool Student Information System (SIS) via the PowerSource support portal. Approximately 29,074 Idaho residents (students, former students, and teachers) were affected. Data included names, contact info, SSNs, dates of birth, and limited medical alerts. PowerSchool engaged forensic experts, reported to law enforcement, and offered two years of credit monitoring via Experian.
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_14ac2c628ad65a74Montana State AGfiled 2025-01-27Candidate
- bd_2390e896c65d5b5fIowa State AGfiled 2025-01-27Verified
- bd_438ff508f653f09dMaine State AGfiled 2025-01-27Verified
- bd_44f09dcd18ee4d0bVermont State AGfiled 2025-01-27Verified
Show 2 more filings ↓Show fewer ↑
- bd_9a98070b775c7a1cNew Hampshire State AGfiled 2025-01-27Verified
- bd_ec1bace9d0e95897Idaho State AGfiled 2025-01-27Verified
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2025/01/1-27-2025-PowerSchool.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 27, 2025
- Raw hash
- 085f6d0cf7ace6c643bb3cdb3f2cfbbcb360885ce227ea7b188be74f6521d04b
Reporting entity
- Name
- ROPES & GRAY LLPnorm: ropes gray
Victim entity
- Name
- PowerSchoolnorm: powerschool
Incident
- Discovered
- Dec 28, 2024
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 29,074
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.