Fraud Management & Cybercrime
,
Incident & Breach Response
,
Ransomware
After Vendor Paid for Data-Deletion Promise, Criminals Extort Schools Directly
Students, gather round for the sad story of how PowerSchool got schooled by hackers, paid them for a promise, then saw that promise get broken.
See Also: OnDemand | Resilience in Crisis: Recovering Your Minimum Viable Company Fast
After being breached last December, PowerSchool, which makes a widely used K-12 student information system platform, said it made the “difficult decision” to pay a ransom to its attackers. In return, the criminals promised to delete the data they stole, PowerSchool this week told affected schools, students and their parents and guardians.
Five months later, an IT administrator at an affected school district alerted me to a new twist: “Surprise! The attackers didn’t delete the data that PowerSchool paid a ransom to have them delete.”
A “PowerSchool Cybersecurity Incident – Update” issued Wednesday by the vendor, which the administrator shared with me, warns “valued customers” that shakedown demands tied to “data from the previously reported December 2024 incident” are now hitting schools.
“We do not believe this is a new incident,” PowerSchool said of the stolen data the extortionists appear to possess.
In its note, the company confirmed publicly for the first time that it chose to pay attackers, hoping it would keep the information on students and faculty from becoming public. “In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve,” the company said. “It was a difficult decision, which our leadership team did not make lightly. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”
In the end, the criminals who pinky-promised to delete the data they stole, if only the victim paid a ransom, didn’t really delete the data. Either they or a trusted intermediary – or maybe just another random bunch of crooks who bought a copy of the data to try their hand at some extortion – are now attempting to directly extort individuals whose personal information they possess.
PowerSchool’s alert arrived the same day that the state of North Carolina warned school districts and charter schools about active PowerSchool user extortion attempts, as Databreaches.net first reported.
For North Carolina schools, the exposed data included names of students and staff, contact information, Social Security numbers – full for staff, partial for students – as well as birthdates, some passwords, parent or guardian information and medical notes.
Who could have predicted that criminals wouldn’t honor their promise (see: PowerSchool’s Breach Fallacy: Paying Criminals for Promises)?
PowerSchool is the victim here, but how it responds matters. If a bully steals your school report, do you pay off the bully to stop?
Experts have long advised victims to never pay, precisely because you can’t trust criminals, as they continue to prove. On the other hand, one expert told me, in a non-zero number of cases criminals do end up not leaking data as a result of getting paid. Until – or if – governments ban such payments, this option remains on the table for businesses.
The downsides are huge: Paying directly funds the cybercrime ecosystem. Groups plow these funds not just into luxury cars, but also research and development. Seeing big ransoms get paid – such as by casino and hotel giant Caesars Entertainment after a September 2023 breach, or UnitedHealth Group over the February 2024 Change Healthcare breach – spawns copycats.
Hence, paying leads to more future victims, as well as to some organizations getting revictimized when criminals fail to keep their word.
Just because data hasn’t leaked yet doesn’t mean it won’t get dumped later. “They’re not going to delete your data,” Allan Liska, a threat intelligence analyst at Recorded Future, previously told me, noting that there is no evidence in the history of the world that involves a ransomware group having kept any data-deletion promise.
“I mean, just flat out, they’re going to pretend to leak your data, they’re going to make a copy of it and then secure delete it in front of you and make a big show of deleting the copy or even deleting the original and keeping the copy,” he said. “We’ve seen that time and time and time again.”
Even so, victims keep paying and paying. In some cases, this appears to be a cynical marketing ploy, so they can claim to be doing something proactive after failing to prevent the problem. Regardless, no one should be under any illusion that paying ever delivers a fairytale ending.
Updated May 8, 21:39 UTC: This blog post has been updated throughout to reflect the possibility that a non-zero number of cybercrime groups don’t end up dumping stolen information once they’re paid.