U.S. school districts affected by the recent cyberattack on edtech giant PowerSchool have told TechCrunch that hackers accessed “all” of their historical student and teacher data stored in their student information systems.
PowerSchool, whose school records software is used to support more than 50 million students across the United States, was hit by an intrusion in December that compromised the company’s customer support portal with stolen credentials, allowing access to reams of personal data belonging to students and teachers in K-12 schools. The attack has not yet been publicly attributed to a specific hacker or group.
PowerSchool hasn’t said how many of its school customers are affected. However, two sources at affected school districts — who asked not to be named — told TechCrunch that the hackers accessed troves of personal data belonging to both current and former students and teachers.
“In our case, I just confirmed that they got all historical student and teacher data,” the person at one affected school district told TechCrunch. The person added that while PowerSchool said the hackers had access to its data from late December, the district’s logs show that the attackers had gained access earlier.
Another person, who works at a school district with almost 9,000 students, told TechCrunch that the attackers accessed “demographic data for all teachers and students, both active and historical, as long as we’ve had PowerSchool.”
“We have seen this access in our logs and [PowerSchool] has disclosed it in customer calls,” the second person said. They added that PowerSchool did not secure the affected system with basic protections, such as multi-factor authentication.
When reached by TechCrunch, PowerSchool spokesperson Beth Keebler did not dispute the customers’ accounts but declined to discuss its security controls, citing company policy. When asked whether PowerSchool uses multi-factor security across its business, …