HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
PowerSchool Enrollment
bd_b45dd6445b4bef1a · schema v1 · pii pii-v1
Full breach record for PowerSchool Enrollment →PowerSchool Group, LLC experienced a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System (SIS) via the PowerSource customer support portal. Affected data included names, contact info, dates of birth, Social Security Numbers, and limited medical alert information. PowerSchool engaged third-party forensic experts and offered two years of complimentary identity protection and credit monitoring to affected students, educators, and parents.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_0eb42dfe74b34b8fIndiana State AGfiled 2025-01-29Verified
- bd_8e2f8adcb9b0e32dCalifornia State AGfiled 2025-01-27(2d gap)Candidate
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2025/01/PowerSchool-AG-End-User-Notification-Template-US.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 29, 2025
- Raw hash
- cb8b54fcceb72ad5f30a16e883b2629eec6b71d4eec606e170d52c548793a5df
Reporting entity
- Name
- PowerSchool Enrollmentnorm: powerschool enrollment
- Domain
- registration.powerschool.com
Victim entity
- Name
- PowerSchool Enrollmentnorm: powerschool enrollment
- Domain
- registration.powerschool.com
Incident
- Discovered
- Dec 28, 2024
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 weeks(32 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.