HackingEducationTechnologyEducationStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)PHILowContained

OneSchool Global North America

bd_f601050fa97dc34c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 9, 2025

Filed

Jan 31, 2025

To disclose

22 days

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for OneSchool Global North America →

One School Global N.A., Inc. (OSGNA) notified the Maryland Attorney General of a security incident involving its Student Information System (SIS) vendor, PowerSchool. The incident, occurring around December 28, 2024, involved unauthorized exfiltration of personal information from PowerSchool's PowerSource portal by an unknown third party. OSGNA confirmed one Maryland resident was affected, with data including names, addresses, and medical history (doctor's name, medications, medical history). OSGNA activated its incident response team, notified law enforcement, and is coordinating with PowerSchool, which is offering credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Maryland clock✓ MD AG ≤30d22 days discovery → filing

Incident timeline

undetected · 12 days

discovery → filing · 22 days

Dec 28, 2024

Begins

Jan 9, 2025

Discovered

Jan 31, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Part of PowerSchool supply-chain incident (2025) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_fd48c510e4abb6df2025-02-05 · +5dVerified

Name: OneSchool Global North America
norm: oneschool global north america
Domain: na.oneschoolglobal.com

Name: OneSchool Global North America
norm: oneschool global north america
Domain: na.oneschoolglobal.com
Industry: EducationllmTechnologyllm

Discovered: Jan 9, 2025
Breach occurred: Dec 28, 2024
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 10, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Health (basic)PHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 ChannelT1530 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Filed notice with Maryland Office of the Attorney General pursuant to Md. Code Ann., Com. Law § 14 -3504(h)(1)
Initial access: external_remote_services

During the incident: Activated its incident response team to determine the scope of the Security Incident
Communicating with PowerSchool to determine what additional actions PowerSchool is taking to remediate the Security Incident
Informing law enforcement of the Security Incident
Formally notifying the affected Maryland resident of the Security Incident
Providing the impacted Maryland resident with a copy of the notice via U.S. mail, upon request
Changes made: Offering two years of complimentary identity protection services provided by Experian
Offering two years of complimentary credit monitoring services provided by TransUnion
Launching a website and distributing a media release to ensure PowerSchool reaches as many impacted individuals as possible
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: MD AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maryland State AGJan 31 · first · this page

Montana State AG+5d

Pattern: first filing Jan 31 (MD), last Feb 5 (MT) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376278.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 31, 2025
Raw hash: 9d507165285bf00c70576272391ea3bc429d22bc124866fff10a9802134147ba

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityOneSchool Global North America

Victim entityOneSchool Global North America

Incidentdiscovered Jan 9, 2025

Stated responseActivated its incident response team to determine the scope of the Security Incident

ComplianceMD AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov