Fraud Management & Cybercrime
,
Incident & Breach Response
,
Ransomware
Criminals Extort School Employees After Vendor Paid for Data-Deletion Promise
Students, gather round for the sad story of how PowerSchool got schooled not once, but twice.
See Also: OnDemand | Resilience in Crisis: Recovering Your Minimum Viable Company Fast
After being breached last December, PowerSchool, which makes a widely used K-12 student information system platform, said it made the “difficult decision” to pay a ransom to its attackers. In return, the criminals promised to delete the data they stole, PowerSchool told affected schools, students and their parents and guardians.
Five months later, an IT administrator at an affected school district alerted me to a new twist: “Surprise! The attackers didn’t delete the data that PowerSchool paid a ransom to have them delete.”
A “PowerSchool Cybersecurity Incident – Update” issued Wednesday by the vendor, which the administrator shared with me, warns “valued customers” that shakedown demands tied to “data from the previously reported December 2024 incident” are now hitting schools.
“We do not believe this is a new incident,” PowerSchool said of the stolen data the extortionists appear to possess.
The company reiterated that it already paid the attackers. “In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve,” the company said. “It was a difficult decision, which our leadership team did not make lightly. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”
In other words, the criminals who pinky-promised to delete the data they stole, if only the victim paid a ransom, didn’t really delete the data. Either they or a trusted intermediary – or maybe just another random bunch of crooks who bought a copy of the data to try their hand at some extortion – are now attempting to directly extort individuals whose personal information they possess.
PowerSchool’s alert arrived the same day that the state of North Carolina warned school districts and charter schools about active PowerSchool user extortion attempts, as Databreaches.net first reported.
For North Carolina schools, the exposed data included names of students and staff, contact information, Social Security numbers – full for staff, partial for students – as well as birthdates, some passwords, parent or guardian information and medical notes.
Who could have predicted that criminals wouldn’t honor their promise (see: PowerSchool’s Breach Fallacy: Paying Criminals for Promises)?
PowerSchool is the victim here, but how it responds matters. If a bully steals your milk money, do you keep paying off the bully, while spinning what you’re doing as being a public service?
Experts have long advised victims to never pay, precisely because you can’t trust criminals, as they continue to prove.
Paying directly funds the cybercrime ecosystem. Groups plow these funds not just into luxury cars, but also research and development. Seeing big ransoms get paid – such as by casino and hotel giant Caesars Entertainment after a September 2023 breach, or UnitedHealth Group over the February 2024 Change Healthcare breach – spawns copycats.
Hence, paying leads to more future victims, as well as to some organizations getting revictimized when criminals fail to keep their word.
“They’re not going to delete your data,” Allan Liska, a threat intelligence analyst at Recorded Future, previously told me, noting that there is no evidence in the history of the world that involves a ransomware group having kept any data-deletion promise.
“I mean, just flat out, they’re going to pretend to leak your data, they’re going to make a copy of it and then secure delete it in front of you and make a big show of deleting the copy or even deleting the original and keeping the copy,” he said. “We’ve seen that time and time and time again.”
Even so, victims keep paying and paying. A cynic might say that’s so they can claim to be doing something proactive after they failed to prevent the problem.
Forget the fairytales: breached organizations need to be responsible and play it straight.