Educational Institution

PowerSchool Student Information System Data Breach (December 2024)

Prevented by: HSF

An unauthorized party used a compromised credential with password-only access to the PowerSource customer-support portal and exported student and teacher data from PowerSchool SIS environments. Exposed information varied by customer and could include names, contact details, dates of birth, addresses, SSNs or SINs, medical information, grades, parent or guardian data, and passwords. DOJ-related reporting placed the affected population at approximately 62 million individuals, although other reported figures were not reconciled. Matthew D. Lane later pleaded guilty to conduct related to the breach, while subsequent extortion attempts indicated that stolen data may have remained available.

British Library Ransomware Attack October 2023

Prevented by: HSF, PEC · Contained by: EGR

In October 2023, the British Library was targeted by the Rhysida ransomware group, resulting in the encryption and leak of approximately 490,191 files, amounting to 573 GB of data. The breach illustrated vulnerabilities in security protocols due to compromised credentials and the absence of Multi-Factor Authentication (MFA), significantly disrupting library operations and potentially exposing sensitive internal data.

DuoLingo Data Breach August 2023

In August 2023, DuoLingo suffered a data breach affecting over 2.6 million users due to a data scraping attack exploiting an exposed API. Compromised data included names and email addresses, posing risks for phishing attacks. The attack was carried out by unidentified threat actors utilizing automated scripts to extract data from the vulnerable API.

Los Angeles Unified School District (LAUSD) Ransomware Breach

Prevented by: HSF, PEC, EGR

In September 2022, the Los Angeles Unified School District (LAUSD) suffered a ransomware attack by the Vice Society, which impacted over 1,000 schools and around 600,000 students. The breach compromised approximately 500 GB of data, including sensitive personal and educational records, due to exploited vulnerabilities such as lack of multi-factor authentication.