On Jan. 8, families with children in the Harvard schools received the unwelcome news that information about students here had been hacked in a massive cybersecurity breach at PowerSchool, whose software is used by some 18,000 school systems. PowerSchool did not inform its customers of the breach until Jan. 7. The company had been aware of the problem since Dec. 28, 2024.
In a Jan. 9 webinar with customers, a PowerSchool official said an unauthorized person had gained access to the information system by using compromised credentials. The credentials had apparently been available on the dark web for some time before the attack.
According to a letter Superintendent Linda Dwight sent to Harvard families, the stolen information included names, addresses, phone numbers, student IDs, and SASID [state assigned student identifier] numbers, medical alerts (such as an allergy) and medical provider names and contact information. PowerSchool said its other products, such as those with information on special education programs, individual education plans (IEPs), and 504 plans (for students with disabilities), were not compromised.
In a separate letter to educators and staff, Dwight said no Social Security identification numbers had been revealed in the breach. As she later explained at a School Committee meeting, some school districts included Social Security numbers on the PowerSchool system, but Harvard did not do so. Nonetheless, PowerSchool will provide identity protection services and credit monitoring for those whose data was compromised, she wrote.
PowerSchool sent school districts a lengthy letter regarding the breach. In it, the company stated, “Rest assured, we have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination.”
At the Jan. 13 School Committee meeting, Dwight explained more about the event than PowerSchool had initially revealed. Through a third-party cybersecurity firm, she said, PowerSchool paid an undisclosed amount of money to a “threat actor” who has targeted a number of companies. The threat actor’s motive is money, so they do not release the information after receiving payment—because then the next victim would be unlikely to pay. Still, PowerSchool’s cybersecurity firm will continue to monitor the dark web for any of the stolen data.
School Committee member Liz Joyce asked if PowerSchool might begin to charge the district more because this payment was made. But Dwight said the Harvard schools have a long-term contract that sets the price, and PowerSchool’s cost was likely covered by insurance.
PowerSchool, based in California, was formerly a publicly traded company but was acquired last fall by Bain Capital of Boston for $5.6 billion.
