Article
The Rise of Supply Chain Cyber Attacks: How Vendor Trust Becomes the Way In
A supply chain cyber attack abuses a vendor, package or service you already trust. See how XZ Utils, MOVEit and PowerSchool worked and how…
Read more
Significant cyber incident
PowerSchool data breach
In late 2024, an attacker used a PowerSchool contractor's compromised login to reach the student information systems of PowerSchool's school customers and copied data out.
In short
In late 2024, an attacker used a PowerSchool contractor's compromised login to reach the student information systems of PowerSchool's school customers and copied data out. PowerSchool received a ransom demand on 28 December 2024, which threatened data on more than 60 million students and 10 million teachers. In May 2025, US prosecutors in Massachusetts charged a college student, who agreed to plead guilty.
What happened
PowerSchool sells software and cloud services to schools in the United States, Canada and elsewhere. In late 2024 an attacker used the login of a PowerSchool contractor to reach its customer support portal, PowerSource. From there the attacker reached the student information systems of PowerSchool’s school customers and copied data out.
PowerSchool says it became aware of the incident on 28 December 2024. The same day it received a ransom demand. The demand threatened to leak data on more than 60 million students and 10 million teachers worldwide unless 30 Bitcoin, about 2.85 million US dollars at the time, was paid. PowerSchool told school districts on 7 January 2025.
The data varied by school. PowerSchool lists names, contact details, dates of birth, limited medical alert information and, for some people, Social Security or Social Insurance numbers. In May 2025 US prosecutors in Massachusetts charged a college student, who agreed to plead guilty. Canadian and US state regulators opened their own reviews.
Timeline
-
August 2024
PowerSchool later confirms an unknown actor accessed PowerSource with the same compromised support credentials.
-
4 September 2024
Prosecutors say the defendant uses the contractor's credentials to enter the network and takes student and teacher data of one customer.
-
19 December 2024
The defendant leases a server from a cloud storage provider in Ukraine. The compromised account is also active in PowerSource from this day.
-
20 December 2024
Student and faculty data is transferred to the Ukrainian server, according to the charging document.
-
28 December 2024
PowerSchool becomes aware of the incident and receives the ransom demand of 30 Bitcoin. Access with the compromised account ends the same day.
-
7 January 2025
PowerSchool tells school districts it had a cybersecurity incident affecting customer data across the country.
-
20 January 2025
The Privacy Commissioner of Canada says he is in contact with PowerSchool and provincial counterparts.
-
27 January 2025
PowerSchool reports the breach to the Canadian federal privacy office.
-
11 February 2025
The Privacy Commissioner of Canada opens an investigation under PIPEDA.
-
16 May 2025
The plea agreement between the US Attorney for Massachusetts and the defendant is dated.
-
20 May 2025
The US Attorney files a four-count Information against the defendant.
-
21 May 2025
North Carolina's Attorney General says the plea was entered and that his investigation of PowerSchool continues.
-
22 July 2025
The Privacy Commissioner of Canada ends his investigation after PowerSchool's written commitments.
How the attack worked
A contractor login was the way in
Prosecutors say PowerSchool gave a contractor credentials for its network, and that the defendant used them on 4 September 2024 to get in without authorization. PowerSchool’s commitment letter to the Canadian privacy office also says a threat actor used a contractor’s compromised credentials to reach PowerSource and then the student information systems of PowerSchool clients. Using stolen but valid logins fits Valid Accounts. The sources do not say how the credentials were first stolen.
From a support portal to customer data
The letter says the compromised account was used in PowerSource between 19 and 28 December 2024. PowerSchool also confirmed an unknown actor had used the same support credentials in August 2024. The sources describe PowerSource as the door to the customer systems, and the commitments that followed focus on tighter access to it, stronger monitoring and a review of access rights for support agents.
Copying the data out
The charging document says the defendant leased a server in Ukraine on 19 December 2024 and, on 20 December, caused data of students and faculty to be moved to it. It lists Social Security numbers, dates of birth and confidential medical information among the data.
Extortion
On 28 December 2024 PowerSchool received a ransom demand for 30 Bitcoin, with a threat to leak the data worldwide. North Carolina’s Attorney General says PowerSchool later paid a ransom to have the data deleted, and that a hacker then tried to extort North Carolina school districts again. The sources reviewed do not describe the second demand in detail.
Who says who was behind it
Charged by the US Attorney for the District of Massachusetts, Information filed 20 May 2025: Matthew D. Lane, who lived in Worcester County, Massachusetts. The plea agreement is dated 16 May 2025 and he agreed to plead guilty to all four counts. North Carolina's Attorney General, 21 May 2025, ties the case to PowerSchool and says the plea was entered. The Information refers to the company only as "Victim 2". It also names an unnamed co-conspirator (in the telecom extortion, not in the PowerSchool counts). No other public attribution in the sources reviewed.
Impact
The ransom demand threatened data of more than 60 million students and 10 million teachers (US Attorney, charging document). North Carolina's Attorney General says more than 62 million people were affected nationally and nearly 4 million in North Carolina. Sources differ on counts because one is a threat and the other a regulator's figure.
PowerSchool lists names, contact information, dates of birth, limited medical alert information and, for some people, Social Security numbers. North Carolina also lists addresses, names of minors, and medical and disciplinary information. The Privacy Commissioner of Canada says Social Insurance Numbers and, in some cases, medical information of Canadian students, educators and parents were involved across several provinces and territories.
The charging document says the information obtained was worth more than 5,000 dollars, and the agreed Guidelines calculation in the plea agreement treated the loss as more than 9.5 million and not more than 25 million dollars.
PowerSchool offered two years of identity protection to those involved and credit monitoring to adults.
Government and regulator response
- 28 December 2024 to 7 January 2025, PowerSchool: became aware of the incident, deactivated the compromised credential, forced a password reset and required its VPN with single sign-on and multi-factor authentication for PowerSource. It told school districts on 7 January 2025 and offered two years of identity protection, plus credit monitoring for adults.
- 20 January 2025, Privacy Commissioner of Canada: said his office was in contact with PowerSchool and provincial counterparts. PowerSchool reported the breach on 27 January.
- 11 February 2025, Privacy Commissioner of Canada: launched an investigation under PIPEDA.
- 20 May 2025, US Attorney, Massachusetts: filed a four-count Information after a plea agreement dated 16 May.
- 21 May 2025, North Carolina Attorney General: welcomed the case and said his investigation of PowerSchool continues. A later, undated release says a Civil Investigative Demand was sent to PowerSchool.
- 22 July 2025, Privacy Commissioner of Canada: ended the investigation after PowerSchool’s letter of commitment (stronger monitoring, an access review, an independent security assessment and ISO/IEC 27001 recertification evidence by 31 March 2026). The letter is not an admission of liability. The Ontario and Alberta commissioners continued their own reviews.
Lessons
-
One vendor login can open many customers
The charging document and PowerSchool's own letter describe a single contractor's credentials leading to the systems of PowerSchool's school customers.
-
Support portals are part of the attack surface
The path ran through the PowerSource customer support portal. PowerSchool's fixes center on that portal: a VPN with multi-factor authentication, tighter passwords and access controls.
-
Stolen logins can be used quietly for months
PowerSchool confirmed an unknown actor used the same credentials in August 2024, and prosecutors date the first use of the credentials by the defendant to 4 September 2024. The alarm came in late December.
-
Review what support staff can reach
PowerSchool committed to review and readjust system access privileges, including customer support agents, and to show stronger monitoring that can spot irregular activity.
-
Paying may not end the threat
North Carolina's Attorney General says PowerSchool paid a ransom for deletion and that a hacker then tried to extort school districts again.
-
Customers must check their vendors
Regulators and school districts had to act on a breach at a supplier. The Canadian federal commissioner stressed safeguards matched to the sensitivity of children's data.
What to check in your own organization
-
List vendor and contractor accounts
Count every outside login that can reach your systems or your customers' data, and who owns each one.
-
Require MFA on support and admin portals
PowerSchool's after-the-fact fix put its support portal behind a VPN with single sign-on and multi-factor authentication. Do not wait for an incident to do the same.
-
Look for old and unusual use of vendor credentials
The same credentials were used in August 2024 and again later. Review logs for logins from new places, and rotate or retire stale credentials.
-
Limit and time-box remote access
Give support staff only the access they need, only for as long as they need it, and review that list regularly.
-
Watch for bulk data leaving
Set alerts for large exports from student, customer or HR systems, and for transfers to servers in new countries or newly rented cloud hosts.
-
Plan for an extortion note
Decide in advance who handles a ransom demand, who tells regulators and customers, and what you will say about a threat to leak data.
-
Ask your suppliers for evidence
Ask for their access controls, monitoring, breach notice terms and independent assessments, not just a security questionnaire.
Where it happened
Questions
What happened at PowerSchool?
A threat actor used a contractor's compromised credentials to reach PowerSchool's customer support portal and then the student information systems of its school customers. PowerSchool became aware on 28 December 2024.
How many people were affected?
The ransom threat named more than 60 million students and 10 million teachers. North Carolina's Attorney General says more than 62 million people were affected nationally. The exact total is not given in the sources reviewed.
Who was charged?
The US Attorney for Massachusetts filed an Information on 20 May 2025 against Matthew D. Lane, charging cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers and aggravated identity theft. The plea agreement shows he agreed to plead guilty to all four counts.
What data was taken?
PowerSchool lists names, contact information, dates of birth, limited medical alert information and, for some people, Social Security numbers. Exact data varied by school.
Did regulators act?
Yes. The Privacy Commissioner of Canada investigated from 11 February 2025 and ended it on 22 July 2025 after PowerSchool's commitments. North Carolina's Attorney General opened an investigation. Ontario and Alberta commissioners were also reviewing the case.
Did PowerSchool admit fault?
Its letter of commitment to the Canadian federal commissioner says it is not an admission of liability or wrongdoing.
In our research
Sources
- US v. Matthew D. Lane, Information (Case 4:25-cr-40015) US Attorney, District of Massachusetts (justice.gov)
- US v. Matthew D. Lane, Plea Agreement US Attorney, District of Massachusetts (justice.gov)
- PowerSchool end user notification template (US) PowerSchool, filed with the California Attorney General
- Letter to families regarding the PowerSchool incident (9 January 2025) A school district, filed with the California Attorney General
- Notice to the SCESD community (24 January 2025) A school district, filed with the California Attorney General
- Statement by the Privacy Commissioner regarding reports of a data breach at PowerSchool (20 January 2025) Office of the Privacy Commissioner of Canada
- Statement by the Privacy Commissioner regarding the data breach at PowerSchool (11 February 2025) Office of the Privacy Commissioner of Canada
- News release: PowerSchool commits to strengthened breach measures (22 July 2025) Office of the Privacy Commissioner of Canada
- Letter of Commitment to the Office of the Privacy Commissioner of Canada Office of the Privacy Commissioner of Canada (signed by PowerSchool)
- Attorney General Jackson Provides Update on PowerSchool Breach and Investigations (21 May 2025) North Carolina Department of Justice
- Attorney General Jeff Jackson Demands Accountability from PowerSchool over 2024 Data Breach North Carolina Department of Justice
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.