Lessons From PowerSchool’s Big Breach

•
January 24, 2025    

Clear lessons have already emerged from PowerSchool’s investigation into the massive theft of its customers’ data.

See Also: Uncovering Risk With Social Due Diligence

A main takeaway is that the vendor failed to use multifactor authentication to safeguard access to its accounts – and had MFA been in place, it likely would have prevented the breach.

“Security features such as MFA should be configured as basic table stakes for any online systems, in particular those that store sensitive data such as that of children,” said cybersecurity expert Brian Honan, owner of BH Consulting, who also founded Ireland’s first computer emergency response team.

“If you are employing a third-party platform for any critical services you should perform regular risk assessments to determine if the security controls in that platform are appropriate for your needs,” Honan said. “You should demand from the vendor that they provide those security features or look toward third-party solutions to address any security gaps you have identified.”

The data breach appears to trace to a remote support tool called PowerSource installed by default as part of the PowerSchool installation. PowerSource gives PowerSchool’s customer support team full, direct access to a customer’s databases.

The attacker appears to have obtained a valid PowerSource customer support username and password and used the access to steal customer data.

Investigators have yet to quantify the number of child and adult breach victims. PowerSchool’s investigation into the December 2024 breach is ongoing and is being led by incident response firm CrowdStrike. The educational software vendor says its software stores information pertaining to 60 million K-12 students and teachers across more than 18,000 customers. Confirmed breach victims include schools and districts in the U.S., Canada, Bermuda as well as some international American schools.

While some schools in the Britain use PowerSchool, the U.K. Information Commissioner’s Office has not received any reports of domestic schools being impacted by the data theft, a spokesperson told me.

Despite many details of the attack not yet coming to light, numerous class action lawsuits have been filed over the breach in the U.S. (see: PowerSchool Faces 23 Lawsuits Over Schools’ Mega Data Breach).

The attackers claim to have stolen personal data pertaining to 62.4 million students and 9.5 million teachers, Bleeping Computer reported Wednesday. That claim couldn’t be verified. If true, that would make the breach one of the 10 largest in 2024.

One exacerbating factor is that many PowerSchool users appear to have been keeping extensive amounts of historical data in their system. The Toronto District School Board said the breach may have exposed data pertaining to students from as far back as 1985, Rogers Media reported. The Privacy Commissioner of Ontario is investigating the matter.

Customers said they’re hoping to see a root cause analysis of the breach from PowerSchool when its investigation concludes.

Already, some clear lessons have emerged:

• Make multifactor authentication mandatory: Given the ease of credential-stuffing attacks, vendors must safeguard all remote access using MFA and VPNs. Despite repeated evidence highlighting such facts, PowerSchool does not appear to have done that prior to the breach; only after.
• Practice data minimization: Why were schools still storing so much historical data? “The old adage of ‘if you don’t store it you don’t need to secure it’ rings true when it comes to data,” Honan said.
• Keep customers apprised: The IT administrator for a school district that’s used PowerSchool since 2008 told me that despite extensive training, no one – including their PowerSchool administrator who has attended numerous training sessions – knew PowerSource was being installed by default. This access bypassed the school district’s internal authentication controls, which included MFA.
• Lockdown guidance: To the above point, why wasn’t PowerSchool detailing essential hardening steps all customers could take to ensure that the software would be locked down to the maximum possible extent?
• Play it straight: One of PowerSchool’s first communications to breach victims highlighted how the organization had paid attackers for a promise to delete stolen data. Critics might accuse the company of attempting to minimize the damage via such communications. Experts also say such criminal promises are empty and that there’s no evidence an attacker has ever deleted stolen data (see: PowerSchool’s Breach Fallacy: Paying Criminals for Promises).

Customers who have attended PowerSchool’s briefings on the breach said the company appears to have belatedly learned its MFA and VPN lessons. The company also quickly communicated with school districts to warn them about the breach.

Obviously, in both cases, the horse had already exited the left-open barn door and there was nothing customers could do, except try to identify if their data got stolen, perhaps disable PowerSource access and wait for PowerSchool’s breach investigation to conclude.