HackingEducationEducationStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Employee Data InvolvedIdentity (basic)Government IDPHIEmploymentCriticalContained

Maryland State Department of Education

bd_f1054e4230dfcee4 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Dec 28, 2024

Filed

Apr 23, 2026

To disclose

—

Affected

177,658state residents only

Confidence

65%

Full breach record for Maryland State Department of Education →

Maryland State Department of Education (MSDE) reported a breach involving PowerSchool SIS affecting 177,658 individuals (155,452 students and 22,206 teachers). The incident occurred between Dec 19-28, 2024, when a threat actor accessed the PowerSource Portal using valid credentials due to lack of MFA/VPN. Data exfiltrated included names, addresses, SSNs, EINs, and some PHI. MSDE acted as the reporting entity for seven affected school districts. Remediation included engaging CyberSteward, strengthening passwords, blocking access, and providing credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

Dec 19, 2024

Begins

Dec 28, 2024

Discovered

Apr 23, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed177,658 affectedView incident

Name: Maryland State Department of Education
norm: maryland state department of education
Domain: marylandpublicschools.org

Name: Maryland State Department of Education
norm: maryland state department of education
Domain: marylandpublicschools.org
Industry: Educationllm

Discovered: Dec 28, 2024
Breach occurred: Dec 19, 2024 – Dec 28, 2024
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2025
Affected individuals: 177,658state-resident count only
Data types: Identity (basic)Government IDPHI
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Reported incident to Maryland’s SOCSubmitted consolidated report to MD PIGA via MSDE
Initial access: valid_credentials

During the incident: Engaged CyberSteward to assist with the investigation
Engaged cybersecurity response protocols and mobilized a cross-functional response team
Engaged third-party cybersecurity experts
Assessed the scope of data involved
Made further enhancements to cybersecurity defenses
Strengthened passwords
Blocked access to PowerSource
Notified impacted schools districts
Set up notification to impacted individuals
Provided credit monitoring and identity protection
Changes made: Instituted new administrative policies to secure the system
Strengthened passwords
Blocked access to PowerSource
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376816.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 23, 2026
Raw hash: 1ea44486b4f8d94a56d9d1c6f0007cc223f512693317775dda0109e8961fe807

Reporting entityMaryland State Department of Education

Victim entityMaryland State Department of Education

Incidentdiscovered Dec 28, 2024

Stated responseEngaged CyberSteward to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov