PowerSchool Data Breach

[jeanmeslier]

Can anyone give me more info about the data breach that just happened with PowerSchool?  Has there been any kind of official press release or written notice yet?

[jamiem7]

Thank you for reaching out. We recommend working with the Technical Contacts in your organization who have received communication regarding the data breach.

[DominiqueJ]

I'm the Technical Contact and haven't received nearly enough information about the breach.

 How will Technical Contacts receive details on directly impacted families/staff? While we've received information on how to review logs (which is how we confirmed how many records were exported), we have yet to receive a copy of exported data to confirm exactly who was impacted. 

When will we get information on the monitoring services? Our Jan. 8th notification stated" PowerSchool will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations"...but we haven't received any additional information here.

[rbusby]

I second @DominiqueJ 's request - specifically about the question about monitoring services.  We have had inquiries about credit monitoring services. We need to know what to tell parents (e.g. a URL they can check (e.g. online form) or an email address they can use to request monitoring support).

[MaryD2]

PowerSchool needs to do a better job of communicating with its customers about this breach.

[scottmecca]

@jamiem7 - I would ask that if you are a Powerschool employee or contractor that you not push these questions off on "others".  Please provide more information.  PS claims to be "transparent" regarding communication on this issue. Still, the fact that we have to go to a community forum, that is not public, in which it is tough to find information suggests otherwise.  We need help.  Please take our questions to management.  I still have not heard from my account managers!

[rbusby]

Great post.  As of this morning we have parent inquiries to us asking about what credit/identity protection services are being offered (parents report that they are still concerned, even after assurances that no credit card/banking information was included in the breach, that the personal identifying information is significant and puts them at risk for identity theft.  In short: @PowerSchool: What URL can we send to parents to see your response to these concerns?    

[chayeslnsd]

Here is a really unhelpful link that was just shared with me: https://www.powerschool.com/security/sis-incident/

[rbusby]

Thank you @chayeslnsd - It's at least a landing page we can share!

[Reshma]

Thank you for sharing your feedback.

We have forwarded this directly to our leadership team, who is currently reviewing all questions. We appreciate your patience during this.

[acarrasquillo]

How does a district go about contacting PowerSchool for credit monitoring for the affected users?

[JohnnaD]

With the Cybersecurity incident our IT guy is looking for ways to help tighten our security.  He is asking me why I continue to keep faculty/staff on Powerschool after they have left the district.......I have never deleted students/faculty/staff from PS only made them inactive or with students transferred them out of the system.  I have always been under the impression the teachers are tied to students through historical data.........Would we want to actually delete them from PS like they had never existed?  Does not make sense to me to delete them.  Any help and guidance would be appreciated.

If I need to post elsewhere, please let me know.

Thank You 

Johnna Dehlinger

USD 389

Eureka KS

[JeffG9]

Make the users Inactive, and clear out their Login/Credentials. Teachers will indeed be attached to many historical records. 

[JohnnaD]

Thank you Jeff, I just wanted to make sure nothing had changed.  I always make staff inactive and take away login credentials.