On January 7, 2025, New Hampshire’s School Administrative Unit (SAU) 21 Superintendent Meredith Nadeau informed parents that their SAU database, managed by PowerSchool, fell victim to a cyberattack. Covering 2,500 students within the school districts of Hampton Falls, North Hampton, Seabrook, South Hampton and Winnacunnet High School, Nadeau has expressed concern. PowerSchool has stated that this was not a cyber-attack directed at the school, but rather a “PowerSchool incident.” But PowerSchool’s cloud-based software platform supports over 60 million students in more than 90 countries and over 18,000 customers. So, a cyber-attack on PowerSchool really is an attack on all students. And with their personal identifying information now compromised, they are not exactly being set up for success.
PowerSchool discovered on December 28, 2024, that hackers used a compromised credential to access the student information system. How much earlier the fraudsters had gained access to the database is unknown. The information that was at these hackers’ fingertips is useful for any identity thief to illegally utilize to make money. Nadeau stated that the hackers accessed and downloaded database tables containing student and teacher information including addresses, grade levels, phone numbers, ethnicity, student alerts, state student ID numbers, and emergency contacts. Many PowerSchool databases across the country contained Social Security numbers.
PowerSchool said they were confident that any data from the incident has been deleted and will not be shared or made public. Confident but not without doubt. They have hired a third-party cybersecurity advisor to negotiate a ransom with the hackers to prevent the public release of the compromised information.
Shout out to SAU 21 Superintendent Nadeau who is taking charge in mitigating loss. While waiting to receive PowerSchool’s third-party investigative review which will hopefully guide internal decisions, she is also contacting the state and federal government departments for support.
Today’s Fraud of The Day is based on article “PowerSchool hack exposes Seacoast schools’ student data: ‘We’re extremely concerned’” published by the Portsmouth Herald on January 9, 2025.
Several local school districts on the Seacoast and in southern Maine announced they fell victim to a cyberattack, which is part of a nationwide breach of data stored in the cloud-based software PowerSchool.
Schools in Hampton, Somersworth, York, and Kennebunk are among the districts that reported they were notified by PowerSchool, a platform that houses data for school districts, about a hack that occurred on Dec. 19. Administrators informed families of the breach on Wednesday.
