HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDEducationEmploymentMediumContained

Grace Joint School District No. 148

bd_bd02ebc50d2d966f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 8, 2025

Filed

Jan 10, 2025

To disclose

2 days

Affected

Not disclosed

Confidence

66%

Full breach record for Grace Joint School District No. 148 →

Grace Joint School District No. 148 reported a cybersecurity incident involving its student information system provider, PowerSchool. On December 22, 2024, a threat actor used compromised credentials to access the PowerSource customer support portal. The actor exfiltrated data from Student and Teacher tables, including PII (names, addresses, emails) and SSNs for a subset of educators. The district discovered the breach on January 8, 2025, deactivated the credentials, and is notifying affected individuals. The incident is considered contained with no ongoing threat.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 2 days

Dec 22, 2024

Begins

Jan 8, 2025

Discovered

Jan 10, 2025

Filed

vs. sector median

8 wks faster

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Grace Joint School District No. 148
norm: grace joint school district no 148

Name: Grace Joint School District No. 148
norm: grace joint school district no 148
Industry: Educationllm

Discovered: Jan 8, 2025
Breach occurred: Dec 22, 2024
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Idaho Attorney General's Office Consumer Protection Division
Third party: via PowerSchool
Initial access: valid_credentials

During the incident: De-activated compromised credential
Investigated access logs
Notifying employees and student families
Checking every student, parent, and faculty's demographic information
Changes made: Ensuring personal identifiable information is no longer entered into PowerSchool
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/01/1-10-2025-Grace-Joint-School-District-No.-148.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2025
Raw hash: 705e1838851e8581cef96df1fd066859c7f61d8e48254f99bffa33328cd996da

Reporting entityGrace Joint School District No. 148

Victim entityGrace Joint School District No. 148

Incidentdiscovered Jan 8, 2025

Stated responseDe-activated compromised credential

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov