Millions of US School Children's Data Exposed in Massive Breach

Tens of Millions of American School Children's Data Exposed in Largest Breach of Their Personal Info to Date: Report

Millions of US schoolchildren have fallen victim to a massive data breach after a company that tracks their personal information reportedly failed to take basic precautions. An investigation from cybersecurity firm CrowdStrike determined that PowerSchool – which operates a widely-used Student Information System (SIS) – was breached in what is likely the biggest hack against American K-12 students in history, NBC news reports.

PowerSchool's SIS software helps schools track students' attendance, grades, addresses, and oftentimes very specific personal information like Social Security numbers or health history. The company has admitted that an "incident" took place which stemmed from a vulnerability in PowerSource, one of its community-focused customer support portals.

PowerSchool disclosed that "current and former students and educators" had their names, contact information, dates of birth, limited medical alert information, Social Security numbers, and "other related information" compromised. There was no evidence that its customers' banking or credit card information was compromised in the breach.

CrowdStrike, which was hired by PowerSchool to investigate the incident, reported that the hacker simply obtained the password of a single employee at PowerSchool and then used a "Maintenance Access" function to let them download the students' information.

While the exact numbers are still unclear, BleepingComputer reported that 62 million students were likely affected by the breach. Beth Keebler, a PowerSchool spokesperson, says, "We recognize the significance of this incident and are deeply regretful that it occurred... PowerSchool has significantly invested in its cybersecurity program, culture, and talent over the years – this has been a diligent and continuous area of focus and one the company plans to continue to invest in." The company also says it is offering two years of complimentary identity protection services to students and educators whose information was involved.