HackingEducationEducationStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)EducationMinorEmploymentCredentialsMediumContained

Notus School District No. 135

bd_dacd873a936b901e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 28, 2024

Filed

Jan 9, 2025

To disclose

12 days

Affected

Not disclosed

Confidence

66%

Full breach record for Notus School District No. 135 →

Notus School District No. 135 notified Idaho residents of a cybersecurity breach involving its PowerSchool Student Information System. On December 28, 2024, PowerSchool detected unauthorized access to its PowerSource support portal via a compromised credential. The incident affected student and teacher data, including names, addresses, phone numbers, emails, dates of birth, and emergency contact information. PowerSchool contained the incident, deactivated the compromised credential, and reset passwords. The district is offering credit monitoring to affected adults and identity protection to minors.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 days

Dec 28, 2024

Discovered

Jan 9, 2025

Filed

vs. sector median

7 wks faster

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Notus School District No. 135
norm: notus school district no 135

Name: Notus School District No. 135
norm: notus school district no 135
Industry: Educationllm

Discovered: Dec 28, 2024
Materiality determined: —
Notification sent: Jan 9, 2025
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)EducationMinorEmploymentCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Third party: via PowerSchool
Initial access: valid_credentials

During the incident: Engaged third-party cybersecurity experts
Informed law enforcement
Deactivated the compromised credential
Restricted all access to the affected portal
Conducted a full password reset
Tightened password and access control for all PowerSource customer support portal accounts
Changes made: Providing credit monitoring to affected adults
Providing identity protection services to affected minors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/01/1-9-2025-Notus-School-District-135.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 9, 2025
Raw hash: 38a908d2c1f44f3ec409e02421e7d546bd546eb22d7a5b091d40328b186fdb9a

Reporting entityNotus School District No. 135

Victim entityNotus School District No. 135

Incidentdiscovered Dec 28, 2024

Stated responseEngaged third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov