Maryland State Department of Education

Maryland State Department of Education (MSDE) reported a breach involving PowerSchool SIS affecting 177,658 individuals (155,452 students and 22,206 teachers). The incident occurred between Dec 19-28, 2024, when a threat actor accessed the PowerSource Portal using valid credentials due to lack of MFA/VPN. Data exfiltrated included names, addresses, SSNs, EINs, and some PHI. MSDE acted as the reporting entity for seven affected school districts. Remediation included engaging CyberSteward, strengthening passwords, blocking access, and providing credit monitoring.