PowerSchool discloses breach affecting hosted and self-hosted school k-12 districts

Yesterday, PowerSchool disclosed that on December 28, it had become aware of a data breach that affected some, but not all, of its PowerSchool clients. PowerSchool Student Information System (SIS) is used by school districts worldwide to help schools manage student educational records including grades, attendance, and enrollment.

Emails were sent to all PowerSchool clients yesterday. One version was sent to districts for whom PowerSchool had not found evidence that they were affected. The other email was sent to those whose data had been compromised. Copies of both versions were seen by DataBreaches.

PowerSchool’s notices stressed that no other products were affected.  The notice to affected customers began:

As the Technical Contact for your district or school, we are reaching out to inform you that on December 28, 2024, PowerSchool become aware of a potential cybersecurity incident involving unauthorized access to certain information through one of our community-focused customer support portals, PowerSource. Over the succeeding days, our investigation determined that an unauthorized party gained access to certain PowerSchool Student Information System (“SIS”) customer data using a compromised credential, and we regret to inform you that your data was accessed.

PowerSchool is conducting webinars today and tomorrow to provide additional information and support to clients.

Of particular note in their preliminary notification is that it appears PowerSchool paid the threat actor(s) to delete the stolen data. In a customer FAQ that was stamped “Confidential” but has already been quoted online elsewhere, PowerSchool claims:

Importantly, the incident is contained, and we have no evidence of malware or continued unauthorized activity in the PowerSchool environment. PowerSchool is not experiencing, nor expects to experience any operational disruption and continues to provide services as normal to our customers.

We have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination.

Do they really believe that? Threat actors often offer to show their victims a real-time video of data deletion after payment, claiming that they wouldn’t lie about a data deletion assurance because their reputation depends on them keeping their word. Yet law enforcement has repeatedly found and reported evidence that datasets that were allegedly deleted had not been deleted, and that other copies had been saved by the threat actors.

SysAdmins Help Each Other

In the absence of details in its initial disclosure, a Reddit thread focused on what evidence district sysadmins could find in their logs. As @tcourtney22 wrote:

I found two correlated exports involving the maintenance account (200A0), backed by the following logs:

• ps-log-audit.4.log

• mass-data-import-export-2024-12-22-1.log

1. 12/22/2024 at 4:56 AM → Dumped the Students Table.2024-12-22 04:57:39,551 Module: Students Export ID: 17348520 User ID: 0 Total Records: 17430 Total of Bytes Exported: 15735187 Total Elapsed Time: 0 Hours 0 Minutes 41 Seconds
2. 12/22/2024 at 8:18 PM → Dumped the Teachers Table.Module: Teachers Export ID: 17348537 User ID: 0 Total Records: 4635 Total of Bytes Exported: 1318854 Total Elapsed Time: 0 Hours 0 Minutes 4 Seconds

The unusual part is that we shouldn’t have imports/exports like these running at such odd hours, especially on a Sunday. Adding to the concern, the IP address logged (91.218.50.11) is registered in Ukraine.

Now, if this doesn’t indicate an issue, then it’s one heck of a coincidence.

Looking back at the logs, there was no activity from this account in mid-December until 12/20/2024, when there was a significant spike in activity. It’s possible this was reconnaissance before the export, but that’s just speculation for now.

The maintenance user shows up as 200A0 in the ps-log-audit files.

Those same findings were also found and reported by other sysadmins in that thread. So it appears that the exfiltration began on December 22, was associated with an IP address in Ukraine that belongs to Virtual Systems LLC, and the maintenance user never logged out.

So Many Unanswered Questions as Yet

DataBreaches did not disclose anything publicly until now so as not to interfere with any investigation, but through multiple sources, DataBreaches and the FBI had previously been made aware of a campaign to attack PowerSchool and to extort them.

DataBreaches sent PowerSchool a list of questions last night. There has been no reply, at least as yet. Some of the questions have since been answered by others, but are repeated below anyway for context. Those attending the webinar may wish to pose the as-yet unanswered questions to PowerSchool:

1. Your statement says you first discovered the breach on December 28. When did the first attack actually begin?

2. Did the attacks only affect data hosted on the corporate PowerSchool network or did it also compromise self-hosted powerschool SIS by school districts?

3. Your statement to schools strongly suggests you paid the threat actor to delete data. Please be a tad more transparent. Did you or did you not pay the threat actor to delete data?

4. How did the threat actor sign the extortion note? Did he sign as “ShinyHunters” or did he use a different moniker? If a different one, what did he use? I know he had tried (unsuccessfully I think) to enlist ShinyHunter’s help in extorting you. What I don’t know is how he signed his threats.

5. If you paid an extortion demand, did you pay as part of a scheme with the FBI to find out what data the attacker had and so that the FBI could trace the payment to him?

6. I know threat actors routinely offer to make videos of data deletion. But of course, they may have another set of the data that they don’t delete despite pinky-swearing that they have deleted it all. Do you really believe that all the data were deleted?

7. How many school districts were affected by this breach?

8. How did the threat actor gain access — where did that compromised credential come from? Was it posted on Github somewhere or was there some other way he got it like from infostealer logs or phishing? How many accounts did he have access to?

9. Did the FBI ever contact you before December 28 to warn you about any attack(s)?

10. Did the FBI tell you that they know who the threat actor is?

This post will be updated if more information becomes available.