PowerSchool, a major K-12 software provider serving over 60 million students and 18,000 customers globally, suffered a significant data breach in December 2024. A subsequent investigation by CrowdStrike revealed a concerning detail: the company was initially compromised months earlier, in August 2024.
The December breach involved unauthorized access to PowerSchool’s customer support portal, PowerSource. This portal contained a remote maintenance tool, allowing the attacker to access customer databases and steal sensitive data.
This included full names, addresses, contact information, Social Security numbers (SSNs), medical data, and grades. While PowerSchool hasn’t officially disclosed the number of impacted individuals, initial reports suggested the compromise of data belonging to 72 million people.
A CrowdStrike report, completed on February 28, 2025, confirmed the December intrusion. The attackers used compromised credentials to access PowerSource between December 19th and 28th, 2024.
CrowdStrike confirmed data exfiltration but found no evidence of malware deployment, privilege escalation, or lateral movement to customer systems. Interestingly, by January 2nd, 2025, the stolen data hadn’t appeared for sale or leaked online, suggesting the threat actor may have honored an extortion demand.
However, the most alarming finding was the discovery of earlier breaches in August and September 2024.
CrowdStrike’s report stated: “Beginning on August 16, 2024, at 01:27:29 UTC, PowerSource logs showed that an unknown actor successfully accessed the PowerSchool PowerSource portal using the compromised support credentials.”
The report further clarified: “CrowdStrike did not find sufficient evidence to attribute this activity to the Threat Actor responsible for the activity in December 2024.”
The lack of sufficient historical SIS log data prevented determining if the August and September activity involved unauthorized access to PowerSchool’s student information system (SIS) data.
Sources indicate the PowerSchool Hack affected 6,505 school districts across the US, Canada, and other countries, impacting 62,488,628 students and 9,506,624 teachers.
Helpful Reads:
