Executive Summary

On December 28, 2024, PowerSchool said it became aware that an unauthorized party had exfiltrated personal information from PowerSchool Student Information System (SIS) environments through the PowerSource customer-support portal. Later reporting and forensic summaries place unauthorized activity earlier: CrowdStrike found evidence beginning December 19, while customer guidance reported data first stolen on December 22. PowerSchool notified affected customers on January 7, 2025 and publicly posted an incident disclosure on January 13. (powerschool.com ; techtarget.com ; bleepingcomputer.com )

The reporting identifies use of a compromised credential, but differs on the owner: BleepingComputer describes a subcontractor credential, while NBC and EdTech Innovation Hub describe an employee or privileged account. The credential reached a maintenance function used to export student and teacher tables. PowerSchool and district reporting indicate that affected data varied by customer and could include names, contact information, dates of birth, addresses, U.S. Social Security numbers (SSNs), Canadian Social Insurance Numbers (SINs), medical information, grades, parent or guardian data, and passwords. CrowdStrike reportedly found evidence of exfiltration from student and teacher tables and no evidence that other tables were taken in its investigation; district notifications described broader historical and demographic exposure. (nbcnews.com ; bleepingcomputer.com ; techtarget.com ; edtechinnovationhub.com )

The final population remains imperfectly reconciled. TechTarget reported that DOJ court documents placed exposure at approximately 62 million individuals. Separately, BleepingComputer reported that the attacker claimed 62.4 million students and 9.5 million teachers across 6,505 districts, while its Texas-lawsuit reporting described 62 million students; PowerSchool initially declined to confirm a total. More than 2.7 million current and former Canadian students and approximately 16,000 students at four U.K. schools were separately reported as affected. These figures come from different sources and populations and are not a single verified count. (techtarget.com ; bleepingcomputer.com ; cbc.ca ; techcrunch.com )

PowerSchool paid an undisclosed ransom after a reported demand of approximately $2.85 million in Bitcoin and received purported deletion evidence. Later extortion demands used data from the incident; Newfoundland and Labrador stated that the information was not deleted, while CBC reported that school boards said the data remained in use. Matthew D. Lane was charged in May 2025, later pleaded guilty, and was sentenced to four years in prison, restitution exceeding $14 million, and a $25,000 fine. His criminal disposition resolved his individual case, but not broader group attribution or deletion status. (k12dive.com ; cbc.ca ; gov.nl.ca ; cbc.ca )

PowerSchool engaged CrowdStrike, rotated PowerSource passwords, tightened password policies, monitored for leakage, and offered two years of identity protection and credit monitoring. The cited sources do not establish a complete public dump; earlier reporting said the data was not publicly available at that time, but later sources establish renewed extortion using samples. (bleepingcomputer.com ; powerschool.com ; nbcnews.com ; techtarget.com )

Incident Overview

Timeline

• August–September 2024: CrowdStrike reportedly found earlier PowerSource breaches using the same compromised credentials, but could not establish that the same attacker conducted all three events. Separately, court reporting alleged that Matthew D. Lane accessed PowerSchool data in September using an employee credential. The sources do not establish that Lane’s alleged access was the same event as either earlier PowerSource breach. (k12dive.com ; bleepingcomputer.com )
• December 19–23, 2024: CrowdStrike’s timeline identified suspected unauthorized activity beginning December 19. Customer guidance cited by BleepingComputer placed the first theft on December 22, six days before PowerSchool’s awareness date. (techtarget.com ; bleepingcomputer.com )
• December 28, 2024: PowerSchool said it became aware of unauthorized exfiltration from certain SIS environments. The alleged extortion demand for approximately $2.85 million in Bitcoin was also reported on this date; the amount PowerSchool ultimately paid was not disclosed. (powerschool.com ; k12dive.com )
• January 7, 2025: PowerSchool said it notified affected SIS customers. Newfoundland and Labrador received notice the same day and began its cyber and privacy response. (powerschool.com ; gov.nl.ca )
• January 8, 2025: Newfoundland and Labrador notified its privacy commissioner, submitted a breach report, and informed school organizations and the teachers’ association. TechTarget separately reported that some districts began notifying parents and staff on January 8; this was not a general notification start date. (gov.nl.ca ; techtarget.com )
• January 13, 2025: TechTarget reported that PowerSchool publicly disclosed the incident on its website. This is distinct from PowerSchool’s January 29 website notice and press release beginning individual notification. (techtarget.com ; powerschool.com )
• January 17–29, 2025: PowerSchool issued customer next steps on January 17, then began individual notification through a website notice and press release on January 29. (powerschool.com )
• February 7, 2025: PowerSchool confirmed that four U.K. schools and approximately 16,000 students were affected. TechCrunch reported that PowerSchool would not offer credit monitoring outside the United States and Canada; the ICO had not received a report, and PowerSchool said it had not filed because it did not consider itself a U.K. data controller. TechCrunch did not establish whether that legal position was correct. (techcrunch.com )
• February 28, 2025: CrowdStrike delivered its investigation report. PowerSchool had engaged the firm to assess scope and misuse. (techtarget.com )
• March 2025: BleepingComputer reported that PowerSchool published the CrowdStrike investigation in March, without specifying a publication day, and that it included findings about earlier PowerSource activity. (bleepingcomputer.com )
• May 7–9, 2025: TechTarget reported that May 7 extortion emails containing data samples went to schools in Canada and North Carolina. K-12 Dive reported threats from North Carolina to Toronto and said four districts had been contacted as of the publication week. PowerSchool confirmed it had paid a ransom shortly after discovery; an FBI investigation was ongoing. (techtarget.com ; k12dive.com )
• May 20, 2025: DOJ information about Lane’s plea agreement became public. (techtarget.com )
• October 15, 2025: CBC reported that Lane had been sentenced to four years in prison, more than $14 million in restitution, and a $25,000 fine. (cbc.ca )

Systems and scope

The targeted service was PowerSource, a customer-support portal used to provide maintenance access to customer PowerSchool SIS instances. The affected product was SIS; PowerSchool said it had no evidence that other PowerSchool products, banking information, or credit-card information were affected. (powerschool.com ; bleepingcomputer.com )

PowerSchool supports more than 18,000 educational customers and over 60 million students, but it said only a subset of SIS customers was affected and initially declined to publish a district count. Later reporting cited approximately 62 million individuals in DOJ-related reporting, 62 million students in the Texas-lawsuit reporting, 62.4 million students and 9.5 million teachers claimed by the attacker, and 6,505 districts; those figures were not reconciled and should not be treated as one verified count. (techtarget.com ; bleepingcomputer.com )

Organizational and legal follow-up

PowerSchool activated incident-response procedures, retained CrowdStrike, communicated with customers, and offered monitoring and identity-protection services. Districts and provincial authorities issued local notifications and reports; Newfoundland and Labrador directly notified affected teachers and later students with higher-risk records. (powerschool.com ; gov.nl.ca )

Renewed demands were reported to U.S. and Canadian law enforcement, and the FBI investigation was ongoing in May. Texas later sued PowerSchool, alleging violations of Texas consumer-protection and identity-theft statutes; the cited report does not establish that those allegations were adjudicated. K-12 Dive separately reported that more than 100 districts had sued PowerSchool, attributing that figure to its reporting source rather than presenting it as a verified court count. (k12dive.com ; bleepingcomputer.com ; k12dive.com )

Technical Root Cause Analysis

Findings

Available reporting identifies credential-based access and reports no CVE, malware, or backdoor; it does not prove that no software defect contributed. The reporting differs on the credential owner: BleepingComputer identifies a subcontractor credential, while NBC and EdTech Innovation Hub describe an employee or privileged account. PowerSchool’s own notice does not identify the owner. The sources do not explain how the password was obtained or identify an affected software version. (bleepingcomputer.com ; nbcnews.com ; edtechinnovationhub.com ; powerschool.com )

The reporting identifies an MFA control gap on the accessed path, but its scope differs. TechCrunch said the hacked account lacked MFA; K-12 Dive reported that PowerSource lacked multifactor authentication; NBC reported that one account used to access and download records did not have two-factor authentication. PowerSchool said most other systems required MFA. These reports support password-only access for the relevant account or path, not a finding that every PowerSource or PowerSchool account lacked MFA. (techcrunch.com ; k12dive.com ; nbcnews.com )

Trust-boundary and privilege design

PowerSource was a support portal, but its maintenance capability reached customer SIS instances. The portal contained a maintenance-access tool that allowed PowerSchool engineers to access customer environments for support and performance troubleshooting. The attacker used the “export data manager” to export the Students and Teachers tables to a CSV file. (bleepingcomputer.com )

This architecture created a large potential multi-tenant blast radius behind a support identity. The available evidence does not describe per-customer authorization boundaries, approval gates, field-level restrictions, export-volume controls, or an independent second party for bulk extraction. Those are control questions and proposed design hypotheses, not established findings; the sources do not establish whether such controls existed and were bypassed or were absent.

The evidence-supported chain was:

1. A credential was compromised, although the owner and compromise method are disputed or unknown.
2. Reporting indicates that the relevant account or PowerSource path permitted password-only authentication.
3. PowerSource’s maintenance function provided access to customer SIS instances.
4. The export data manager generated exports of student and teacher tables.
5. Court reporting alleged that Lane transferred stolen data to a leased Ukrainian cloud server; later extortion used data from the incident. (nbcnews.com ; bleepingcomputer.com ; k12dive.com )

Detection and logging

CrowdStrike found evidence of unauthorized activity beginning December 19, while PowerSchool became aware on December 28. A court filing summarized by K-12 Dive alleged that Lane first reached one district’s data in September and later accessed thousands of districts’ data, with more than 100 days before discovery. These are timeline observations; they do not by themselves establish why detection occurred when it did or which controls failed. (techtarget.com ; k12dive.com )

Customer guidance identified the maintenance user 200A0 in ps-log-audit files and advised correlating that activity with mass-data exports. The first reported theft was associated with IP address 91.218.50.11, described as belonging to a Ukrainian website and virtual-hosting company; the source does not establish that the company operated the attack. These were customer-investigation artifacts, and the sources do not establish whether PowerSchool centrally monitored them, whether alerts were generated, or why detection did not occur earlier. (bleepingcomputer.com )

Malware, cryptography, and exploit status

CrowdStrike reportedly found no evidence of malware or a backdoor. No cryptographic failure, protocol weakness, CVE, CVSS score, novel exploit, or software-version defect is identified in the available sources. The evidence therefore describes use of legitimate support functionality and credential-based access, while leaving open whether any unreported software defect contributed. (nbcnews.com ; techtarget.com ; edtechinnovationhub.com )

Mitigating controls and their limits

PowerSchool engaged incident responders and CrowdStrike, deactivated the compromised credential, restricted access to the affected portal, rotated PowerSource passwords, tightened password policies, and monitored the dark web. Newfoundland and Labrador separately performed a full password reset and tightened password and access controls for relevant accounts. These measures were reported as post-discovery response actions; they do not prove that exfiltrated copies were destroyed. (gov.nl.ca ; bleepingcomputer.com )

Attack Vector and Methodology

Initial access

The intrusion involved a compromised PowerSchool credential against the PowerSource customer-support portal. Sources differ on whether the credential belonged to a subcontractor, employee, or privileged support user, and do not establish how it was compromised. Phishing, malware, and social engineering appear in the sources only as possibilities or general context, not as confirmed PowerSchool-specific mechanisms. (bleepingcomputer.com ; techtarget.com ; edtechinnovationhub.com )

TechCrunch, K-12 Dive, and NBC reported MFA limitations for the hacked account or relevant portal. The reporting indicates that password-only authentication was sufficient for the accessed path; it does not document every authentication step. No malware, backdoor, or vulnerability exploit was identified in the reported findings. (nbcnews.com ; techcrunch.com ; k12dive.com )

Progression and collection

PowerSource provided “Maintenance Remote Support operations” that exposed individual customer SIS instances. The attacker used the portal’s maintenance access and “export data manager” functionality to export the Students and Teachers tables to CSV. The reported collection path used an intended administrative support feature rather than a reported malware implant. (techtarget.com ; bleepingcomputer.com )

The relationship between September and December activity is not fully reconciled. Court reporting alleged that Lane first accessed one district’s data in September and later transferred stolen data to a leased cloud server in Ukraine. Separately, CrowdStrike identified suspected activity beginning December 19 and customer reports associated first theft with December 22. The sources do not establish whether the September activity was the same event as the December PowerSource export or how the events relate. (k12dive.com ; techtarget.com ; bleepingcomputer.com )

Exfiltration and extortion

The data was exported from SIS environments and transferred off the platform. One reported first-theft event was associated with 91.218.50.11, an IP address described as belonging to a Ukrainian website and virtual-hosting company; that association is not proof that the company operated the attack. The sources do not provide transfer commands, malware, hashes, encryption details, or a complete network-flow record. (bleepingcomputer.com )

On December 28, the attacker allegedly contacted PowerSchool and demanded approximately $2.85 million in Bitcoin, threatening worldwide disclosure. PowerSchool later acknowledged paying a ransom but did not disclose the amount. The threat actor reportedly supplied a video purporting to show deletion of the only copy; this was a claim or purported evidence, not an established fact. (k12dive.com ; techtarget.com ; bleepingcomputer.com )

Indicators and detection

The most actionable reported customer-investigation artifacts were:

• maintenance user 200A0 in PowerSchool ps-log-audit files;
• mass-data exports temporally correlated with that audit activity; and
• source IP 91.218.50.11. (bleepingcomputer.com )

These are reported indicators and log-review artifacts, not necessarily a complete or vendor-validated IOC set. BleepingComputer advised customers to correlate audit-log activity with mass-data exports. PowerSchool’s awareness on December 28 included the attacker’s contact; the sources do not identify a preventive alert, persistence, lateral movement, privilege escalation beyond existing access, evasion tooling, or a named malware family. (bleepingcomputer.com ; nbcnews.com ; techtarget.com )

Attribution

Lane’s conduct was initially described in allegations and later followed by a guilty plea and sentence. The later extortion activity was not conclusively tied to a single group. A person claiming to be ShinyHunters was reported to be extorting districts, while the group’s leader said the person was a falsely impersonating affiliate. CrowdStrike also could not establish that the same attacker conducted the August, September, and December PowerSource breaches. (cbc.ca ; techtarget.com ; bleepingcomputer.com )

Impact Assessment

Data and population

The breach affected a subset of PowerSchool SIS customers, not every PowerSchool product or every customer. PowerSchool said the exposed information varied by customer and individual and could include names, addresses, contact information, dates of birth, parent or guardian information, U.S. SSNs, Canadian SINs, medical or alert information, and other related information. District-specific reporting additionally described grades, disciplinary records, and passwords. CrowdStrike reportedly found evidence of exfiltration from student and teacher tables and no evidence that other tables were taken in its investigation; district reports described broad historical and demographic data, so that finding should not be treated as a complete field inventory for every district. (powerschool.com ; techtarget.com ; nbcnews.com ; bleepingcomputer.com )

PowerSchool said the majority of individuals did not have medical-alert information or an SSN involved. (powerschool.com )

The global count is not settled. PowerSchool initially said it could not confirm a precise number; later DOJ-related reporting cited approximately 62 million individuals. An attacker claim described 62.4 million students and 9.5 million teachers across 6,505 districts, while BleepingComputer’s Texas-lawsuit report described 62 million students. PowerSchool serves more than 60 million students and 18,000 customers. These are different denominators and should not be treated as one verified count. (techcrunch.com ; techtarget.com ; bleepingcomputer.com )

Reported jurisdictional counts demonstrate the historical reach. CBC reported that more than 2.7 million current and former Canadian students were affected; this is a reported national figure, not reconciled here with all other counts. Newfoundland and Labrador reported 270,812 students and 14,346 teachers, including student records dating to 1995 and teacher records to 2010; Toronto reported data potentially dating to 1985; and four U.K. schools reported approximately 16,000 students. (cbc.ca ; gov.nl.ca ; therecord.media ; techcrunch.com )

Operational and human consequences

PowerSchool said operations continued normally, and Newfoundland and Labrador said its school operations and classroom instruction were not disrupted. These statements do not establish the absence of operational impact for every district. The direct reported harm was confidentiality loss and persistent identity risk, especially where government identifiers, health information, or historical records were included. (powerschool.com ; gov.nl.ca )

The later use of stolen data for extortion created a second incident for school boards and families. Toronto, Peel, Calgary, North Carolina districts, and other boards reported demands or ransom solicitations, and the demands were reported to law enforcement. These reports establish threats and use of samples or claimed stolen data, not a confirmed complete public release or proof that every named board was part of one campaign. They contradicted earlier assurances that the data had been deleted. (cbc.ca ; k12dive.com )

Legal, financial, and regulatory effects

PowerSchool paid an undisclosed amount after an approximately $2.85 million Bitcoin demand was reported. The later extortion, more than 100 district lawsuits as reported by K-12 Dive, and a Texas attorney general lawsuit alleging statutory security and disclosure violations increased financial and legal exposure; the Texas allegations were not established as adjudicated violations in the cited source. (k12dive.com ; bleepingcomputer.com )

PowerSchool offered two years of identity protection and adult credit monitoring in the United States and Canada, while international support differed; it told TechCrunch that it would not offer credit monitoring outside those countries. The U.K. ICO had not received a report, and PowerSchool attributed that to its position that it was not a U.K. data controller; the source did not resolve that position. (powerschool.com ; techcrunch.com )

Lane’s later guilty plea and sentence—four years in prison, more than $14 million restitution, and a $25,000 fine—provided a law-enforcement outcome for his case, but did not resolve broader co-conspirator or group attribution or whether all stolen copies were destroyed. (cbc.ca ; techtarget.com )

Recommendations and Prevention

The following source-backed recommendations should be distinguished from the reviewer-proposed engineering controls below. EdTech Innovation Hub recommends MFA, least privilege, penetration testing, Continuous Threat Exposure Management (CTEM), and robust incident response. K-12 Dive identifies MFA as standard practice and reports FBI guidance that victims should not pay ransomware demands because payment does not guarantee recovery or deletion. (edtechinnovationhub.com ; k12dive.com ; k12dive.com )

Reviewer-proposed engineering controls: privileged MFA

PowerSource and the accessed account were reported to permit password-only authentication on a path reaching sensitive SIS data. As a proposed control, require phishing-resistant hardware-backed MFA, such as FIDO2 security keys, for every employee, subcontractor, and support identity that can invoke maintenance access, with no emergency or legacy exemption. If the attacker had no second factor, MFA would likely have prevented password-only access, but the sources do not establish that it would certainly have stopped every possible attack. (techcrunch.com ; nbcnews.com ; k12dive.com )

Implementation could bind the key to the workforce identity and require step-up authentication for maintenance and export operations. Password rotation is useful after compromise but is not a substitute for a second factor. (edtechinnovationhub.com ; k12dive.com )

Reviewer-proposed engineering controls: customer-scoped support access

As a proposed architecture, separate the support plane from customer data access with per-customer authorization, just-in-time approvals, and a control that prevents a support session from exporting an entire student or teacher table without independent approval. Maintenance access should expose only the minimum records and fields required for an approved ticket; bulk export could require a second authorized operator, a documented purpose, and a time-limited token. These controls are proposed responses to the reported maintenance/export capability, not findings that the cited sources establish were absent. (bleepingcomputer.com ; techtarget.com )

For example, a customer-scoped query service could deny Students and Teachers table dumps, mask identifiers by default, and release only an approved diagnostic sample. Least privilege and access-control permissions were specifically recommended in the breach analysis. (edtechinnovationhub.com )

Reviewer-proposed engineering controls: collection detection

Treat maintenance exports as high-risk data movement. Alert and, unless explicitly approved, block anomalous export volume, cross-tenant access, CSV generation, access to historical records, and transfers to previously unseen infrastructure. Correlate portal identity, customer tenant, maintenance user, export count, destination, and time in a central detection pipeline. (bleepingcomputer.com )

A concrete control could alert on 200A0 activity in ps-log-audit when a corresponding mass-data export appears, quarantine the session, and deny egress until a customer owner approves it. The reported IP 91.218.50.11 and December 22 theft were retrospective investigation opportunities; the sources do not establish that centralized detection could have acted on them at the time. Egress controls would not prevent initial credential use or small, low-and-slow theft, so they should complement MFA and export authorization. (bleepingcomputer.com )

Reviewer-proposed governance controls: retention and compartmentalization

As proposed governance controls, districts and vendors could set documented retention limits, inventory fields before onboarding, and delete records that no longer serve a documented purpose. Newfoundland and Labrador and Toronto reported historical data reaching back decades, demonstrating increased potential impact but not establishing a required retention period or proving that inconsistent retention caused the exposure window. (gov.nl.ca ; therecord.media )

As a proposed design objective, tenant-specific encryption keys held outside the support plane, field-level encryption or tokenization for SSNs/SINs and health data, and separate key authorization from database administration could reduce the value of a table dump. Whether such controls would prevent one support credential from unlocking high-risk fields is architecture-dependent; the sources do not describe PowerSchool’s encryption architecture. The vendor’s notice confirms that data categories varied by customer, supporting customer-level inventory and minimization. (powerschool.com )

Plan for data extortion without relying on deletion promises

Incident response should assume that a paid extortionist may retain copies. Preserve evidence, notify affected customers and law enforcement, monitor for targeted samples and re-extortion, and maintain a decision process that does not treat a deletion video as proof. The FBI guidance reported by K-12 Dive says victims should not pay because payment can embolden threat actors and does not guarantee return or deletion; this is reported guidance, not a universal legal rule. (k12dive.com ; k12dive.com ; cbc.ca )

Operationally, vendors could provide customers with reported indicators, notification templates, and log-review instructions; customers should report scams and demands promptly. Newfoundland and Labrador performed password and access-control resets and directed suspected scams to police and the Canadian Anti-Fraud Centre. (gov.nl.ca ; bleepingcomputer.com )

Conclusion

Three findings are most material. First, available reporting identifies credential-based access and an MFA gap on the relevant account or path, but does not establish the credential owner, compromise method, or absence of every possible software contribution. Second, the support function’s reach across customer SIS environments and the presence of a bulk-export capability created substantial potential impact; long-retained historical records increased that impact. Third, payment and purported deletion evidence did not resolve the risk that copies remained available, as later extortion demands used data from the incident. (nbcnews.com ; bleepingcomputer.com ; therecord.media ; gov.nl.ca )

The global affected population remains unreconciled: approximately 62 million individuals in DOJ-related reporting, 62 million students in the Texas-lawsuit reporting, and the attacker’s claim of 62.4 million students and 9.5 million teachers are distinct, unconfirmed figures. The September activity, December activity, credential ownership, and relationship among the August, September, and December PowerSource events also remain only partly reconciled. (techtarget.com ; bleepingcomputer.com ; k12dive.com )

PowerSchool’s paid amount remains undisclosed; the reported $2.85 million was the demand attributed to the attacker, not necessarily the amount paid. Deletion was not verified, and Newfoundland and Labrador stated that the information was not deleted; later board extortion demands further contradicted earlier assurances. Lane’s guilty plea and sentence resolved his individual criminal case but not the broader group attribution or deletion questions. (k12dive.com ; cbc.ca ; gov.nl.ca ; cbc.ca )

The reported response actions included credential deactivation, portal restriction, password rotation, tighter password policies, forensic investigation, and identity-protection services. BleepingComputer separately reported customer log-review guidance and the artifacts 200A0 and 91.218.50.11; Newfoundland and Labrador reported its own password and access-control reset. These actions address response and recovery, while the proposed preventive controls—MFA for privileged paths, customer-scoped authorization, constrained export, strong telemetry, egress monitoring, and retention governance—should be understood as engineering recommendations rather than documented PowerSchool remediation. (gov.nl.ca ; bleepingcomputer.com )

• SIS Incident | PowerSchool
• Notice of Data Breach For Individuals in the United States - PowerSchool
• PowerSchool data breach: Explaining how it happened
• PowerSchool data breach: Impact on Student ...
• PowerSchool data breach leads to school extortion attempts
• College student charged in connection with PowerSchool data ...
• Toronto school district says data not deleted after ransom ...
• Texas sues PowerSchool over breach exposing 62M students ...
• PowerSchool data breach affected 16,000 students in the UK
• PowerSchool Notice of Data Breach - Business Wire
• PowerSchool Cybersecurity Incident - Education and Early Learning, Government of Newfoundland and Labrador
• PowerSchool hack exposes student, teacher data from K-12 districts
• PowerSchool breach worse than thought, company says "all student and teacher data accessed"
• PowerSchool begins notifying students and teachers after massive data breach
• PowerSchool hack: missed basic security step resulted in data ...
• School boards hit with ransom demands linked to PowerSchool breach
• Man behind PowerSchool breach that exposed Canadian students ...