HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDMediumContained

Perkins School for the Blind

bd_eeddd5fa4b8932a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 28, 2024

Filed

Jan 14, 2025

To disclose

17 days

Affected

3state residents only

Linked

4 filings

Confidence

67%

Full breach record for Perkins School for the Blind →2 incidents on file

Perkins School for the Blind notified the New Hampshire Attorney General of a data security incident involving PowerSchool, a third-party data management provider. On December 28, 2024, PowerSchool discovered unauthorized access to its Student Information System (SIS) via a compromised credential. The breach affected 3 New Hampshire residents, involving parent and student contact information and Social Security Numbers. PowerSchool contained the incident, deactivated credentials, reset passwords, and engaged law enforcement (FBI). Perkins is offering credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 days

Dec 28, 2024

Discovered

Jan 14, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_36d19edb5843af812025-01-13 · +1dVerified
Wisconsin State AGbd_dc276ccbcf9c3b6f2025-01-07 · +7dCandidate
Rhode Island State AGbd_e4345d4be5f933602025-02-18 · +35dVerified

Name: Perkins School for the Blind
norm: perkins school for the blind
Domain: perkins.org

Name: Perkins School for the Blind
norm: perkins school for the blind
Domain: perkins.org
Industry: Educationllm

Discovered: Dec 28, 2024
Materiality determined: —
Notification sent: Jan 14, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection and Antitrust Bureau
Third party: via PowerSchool
Initial access: valid_credentials

During the incident: Engaged third-party cybersecurity experts
Informed law enforcement, including the FBI
Isolated the unauthorized access point to the portal
Deactivated the compromised credential
Restricted all access to the affected portal
Conducted a full password reset
Tightened password and access control for all customer support portal accounts
Offered credit monitoring services through Experian Identity Restoration
Changes made: Collaborating with PowerSchool and awaiting their final report on the scope of the breach
Reviewing access management protocols, especially for systems housing sensitive data
Deleted any remaining SSNs from PowerSchool SIS
Ensuring all devices are equipped with software designed to detect and block suspicious activities, websites, and files
Continually assessing vendor security practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 days(17 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Wisconsin State AGJan 7 · first

Massachusetts State AG+6d

New Hampshire State AG+7d · this page

Rhode Island State AG+42d

Pattern: first filing Jan 7 (WI), last Feb 18 (RI) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/perkins-school-blind-20250114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2025
Raw hash: df4f69bdbcc4310db06b0f1ba2e6a1472229a4a96b2e1c7edcb37c2aae3d07e4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPerkins School for the Blind

Victim entityPerkins School for the Blind

Incidentdiscovered Dec 28, 2024

Stated responseEngaged third-party cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov