HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Grace Joint School District No. 148
bd_bd02ebc50d2d966f · schema v1 · pii pii-v1
Full breach record for Grace Joint School District No. 148 →Grace Joint School District No. 148 reported a cybersecurity incident involving its student information system provider, PowerSchool. On December 22, 2024, a threat actor used compromised credentials to access the PowerSource customer support portal. The actor exfiltrated data from Student and Teacher tables, including PII (names, addresses, emails) and SSNs for a subset of educators. The district discovered the breach on January 8, 2025, deactivated the credentials, and is notifying affected individuals. The incident is considered contained with no ongoing threat.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2025/01/1-10-2025-Grace-Joint-School-District-No.-148.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 10, 2025
- Raw hash
- 705e1838851e8581cef96df1fd066859c7f61d8e48254f99bffa33328cd996da
Reporting entity
- Name
- Grace Joint School District No. 148norm: grace joint school district no 148
Victim entity
- Name
- Grace Joint School District No. 148norm: grace joint school district no 148
Incident
- Discovered
- Jan 8, 2025
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notification with Idaho Attorney General's Office Consumer Protection Division
- Third party
- via PowerSchool
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 2 days(2 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.