Worldwide PowerSchool Breach Reaches Pittsfield Schools
PITTSFIELD, Mass. — District students and teachers had their personal information accessed as part of a worldwide PowerSchool breach.
"This is not unique to the City of Pittsfield," Superintendent Joseph Curtis told the School Committee on Wednesday.
"Every one of the 18,000 PowerSchool customers has experienced a data breach. We were informed yesterday with a very brief notice from PowerSchool and our technology department began to dig into the impact near immediately."
The breach reportedly took place between Dec. 19 and 28, when it was detected by PowerSchool and all accounts were locked down. It is being investigated by the FBI and a third-party cybersecurity firm.
On Jan. 8, PowerSchool hosted a webinar with the investigative team to provide school districts with further details about the situation.
The Pittsfield Public School's technology department investigation found that personal information from the fields "Student" and "Teacher" were accessed. This includes home addresses, phone numbers, and email addresses.
Other school districts have reported access to student grades, health information and Social Security numbers.
As a cybersecurity computer science student, School Committee member William Garrity found the breach "deeply concerning."
"I am concerned by the security practice PowerSchool had implemented before this," he said.
"I think there was a lot of this oversight, I'm not going to get into it in this meeting. Hopefully not just us but other districts around Massachusetts, the county, and the world hold PowerSchool accountable for their security practices."
Curtis reported that a hacker got into the information through a compromised PowerSchool employee account that has since been disabled and the software company took immediate steps to secure its system.
"Almost all of the Berkshire County, and certainly across Massachusetts, the United States, and the globe use PowerSchool," the superintendent said.
"There are very few alternatives to student information systems as they are bought up by each other and PowerSchool is certainly one of the main ones. We've had PowerSchool for about 22 years at this point."
PowerSchool will provide credit monitoring to affected adults and identity protection services to affected minors per regulatory and contractual obligations.
"We did two family information releases today and two staff information releases, and then some individual staff contacts as well," Curtis said, adding that additional information about the breach will be shared publicly once it is received.
PowerSchool is a cloud-based software company that provides student information systems (SIS) for K-12 schools. It holds student information such as grades and attendance, administrative tasks, compliance reports, emergency management, and learning tools.
On Thursday, The North Adams Public Schools said its data was not comprised as a part of the breach. However, later in the day, the district reported that student and teacher demographic information may have been compromised.
On Jan. 7, the district was notified by PowerSchool that its support portal was internationally breached and school districts' data had been compromised. After an “extensive internal investigation” including a review of all exported reports, NAPS said there was “no reason to believe that our data was compromised as part of this event.”
"We are certain that Individual Education Plan (IEP) information, student photos, and passwords were not accessed. Additionally, North Adams Public Schools does not store Social Security numbers in PowerSchool,” the district wrote.
A subsequent communication indicated that PowerSchool had confirmed that North Berkshire School Union districts were not affected by the incident but an internal investigation found NAPS may have been.
“However, based on our own internal investigation conducted by our IT Director, we have identified evidence that suggests our data may have been compromised,” a press release reads.
“We are actively working with PowerSchool to fully understand the scope of the breach and confirm its impact. At this time, it appears that student and teacher demographic information may have been accessed.”
The district reiterated that Social Security numbers are not stored in PowerSchool and special education data was not accessed.
“We will continue to collaborate closely with PowerSchool as they complete their investigation and provide further updates,” NAPS wrote.
“We remain committed to keeping the NBSU students, families, and staff members safe and informed. As we receive more information, we will continue to provide updated information.”
PowerSchool indicated that it will continue to provide general updates as the investigation continues and will release a final report at the conclusion.
PowerSchool is in more than 90 countries, providing services to 18,000 educational organizations with more than 60 million students. It offers data management and analytics for enrollment, assessment, special education and student information to streamline administrative tasks.
Tags: cyber security, Pittsfield Public Schools,
