The Rochester City School District (RCSD) issued an urgent warning on Monday about a data breach affecting its student management system, PowerSchool. This RCSD data breach impacts students, families, and staff.
PowerSchool, a third-party vendor used by schools nationwide and internationally, experienced a cybersecurity incident in late December 2024.
PowerSchool reported no evidence of identity theft directly resulting from the community data breach. However, RCSD leadership stated that PowerSchool acknowledged the breach was unavoidable at the district level.
“Starting in the next few weeks, in collaboration with Experian, PowerSchool will provide notice to students (or their parents/guardians, if the student is under 18) and staff whose information was involved and a phone number to answer any questions you may have about the incident. The notice will include the identity protection and credit monitoring services offered, as applicable,” the district announced.
PowerSchool clarified that the attack targeted the company, not individual school systems.
“December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments.” Their statement reads.
Further details about the breach remain undisclosed.
RCSD’s technology team estimates that the breach potentially exposed data for 134,000 students and staff. Compromised information may include names, birthdates, addresses, emails, phone numbers, emergency contacts, and potentially some medical records.
Jonathan Weissman, a cybersecurity professor at RIT, offered strong advice: “Without any hesitation, I strongly urge every single parent out there to freeze the credit reports of all your children at this point in time. It’s much easier for a cybercriminal to steal the identity of your children because they’ve got a blank slate as far as their credit report goes. Data breaches are happening more and more today because it’s becoming easier and easier. The tools and techniques being used by the cybercriminal are refined. There’s also a basic lack of security implementation on that information by third-party companies like PowerSchool.”
For updates, visit the PowerSchool website.
