HackingEducationEducationSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)LowActive

PowerSchool Group, LLC

bd_e4345d4be5f93360 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 18, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

67%

Middletown Public School District notified PowerSchool Group, LLC regarding a data breach occurring on or about December 28, 2024. The incident compromised PII of parents, students, and potentially employees. The district's legal counsel sent a letter to PowerSchool on February 5, 2025, citing obligations under the Rhode Island Identity Theft Protection Act of 2015. The specific extent of the breach and data types remain undetermined.

J jump to incidentP pin to compareR raw source

Incident timeline

Dec 28, 2024

Begins

Feb 18, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_eeddd5fa4b8932a72025-01-14 · +35dVerified
Massachusetts State AGbd_36d19edb5843af812025-01-13 · +36dVerified
Wisconsin State AGbd_dc276ccbcf9c3b6f2025-01-07 · +42dCandidate

Name: Middletown Public Schools
norm: middletown public schools
Domain: mpsri.net

Name: PowerSchool Group, LLC
norm: powerschool group
Domain: mpsri.net
Industry: Educationllm

Discovered: —
Breach occurred: Dec 28, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Notifying the Rhode Island Attorney General's office
Third party: via PowerSchool Group, LLC
Initial access: supply_chain

During the incident: Notifying affected Rhode Island residents within forty-five (45) after confirming the breach
Notifying the Rhode Island Attorney's General office
Notifying major credit reporting agencies
Cooperating with Rhode Island law enforcement in their investigation
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Wisconsin State AGJan 7 · first

Massachusetts State AG+6d

New Hampshire State AG+7d

Rhode Island State AG+42d · this page

Pattern: first filing Jan 7 (WI), last Feb 18 (RI) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://riag.ri.gov/media/7396/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2025
Raw hash: ea498e144daaa0e65fb35d4a92b375af133f25f54c9789972c42d37491414557

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMiddletown Public Schools

Victim entityPowerSchool Group, LLC

IncidentThird-Party / Supply Chain

Stated responseNotifying affected Rhode Island residents within forty-five (45) after confirming the breach

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceriag.ri.gov