PowerSchool Student Information System reports holiday data breach. Baker School District issues local statement

BAKER CITY – Earlier this month, the Baker School District was informed by PowerSchool of a recent data breach involving the Power School Student Information System utilized by the district. This was a national breach that occurred between December 19 and December 24, 2024, involving school districts across the United States. The Baker School District issued a release this week explaining the situation, what the potential implications for the district are, and what action is currently being taken. See the full release below:

(From the Baker School District)

On the afternoon of Tuesday, January 7, 2025, our school district was informed by PowerSchool of a recent cybersecurity incident within the PowerSchool Student Information System (PowerSchool SIS). This incident has had a global impact on its customers, including our district. We are writing to share the information we have at this time, and outline the next steps in our response. Individuals impacted by the breach will be contacted directly with information from PowerSchool related to credit or identity monitoring.

We recognize that incidents like this can cause significant concern, as protecting the privacy and security of personal information is a top priority. Please know that we are working with PowerSchool to better understand the scope of the cybersecurity incident and to ensure that appropriate measures are taken to safeguard the information. We will keep you informed of developments as they become available from PowerSchool. 

Description of the Event

On December 28, 2024, PowerSchool discovered that a threat actor had accessed personal employee and student information from customers using the PowerSchool Student Information System (PowerSchool SIS). The threat actor exploited the user account of a PowerSchool technical support employee, allowing rapid access to and the downloading of millions of records from schools throughout the country between December 19 and December 24, 2024. This incident did not involve our school district’s network security or infrastructure.

More importantly, no passwords or financial information was impacted by this incident. The type of information accessed varies by individual but may include student names, student ID numbers, parent/guardian contact information, date of birth, dates of enrollment or withdrawal reasons, limited medical alert information (e.g., allergies or other conditions), and IEP/504 status. 

Although PowerSchool has assured us that the risk of data dissemination or misuse is low, we remain vigilant and are leveraging all available resources to thoroughly assess the situation.

Next Steps in Response 

Our Technology Department continues to review data and assess any additional actions that may be necessary. We are collaborating closely with other impacted school districts and leveraging our membership in both statewide and national educational technology organizations to ensure we have taken every possible step in responding to this cybersecurity incident.

PowerSchool has provided the next steps it is taking in response to this incident:

PowerSchool has engaged a third-party, cybersecurity firm, to investigate the incident. PowerSchool has implemented additional information security best practices requiring updated credentials for all employees, and restricting access to their support system tools. PowerSchool will also provide credit or identity monitoring services to those impacted depending on the nature of the personal information accessed.

This is the information that we have, so far; and we will share updates as they become available.

__

Note that while this breach involves school districts across the nation, it is limited to districts utilizing the PowerSchool SIS specifically. Districts not making use of the software are unaffected. PowerSchool also issued its own statement on the situation which can be found at https://www.powerschool.com/security/sis-incident/

---

---

• 
• 
• 

---

• 
• 
• 

---