PowerSchool data breach impacted Washington students, staff

WASHINGTON — A “cybersecurity incident” at student information website PowerSchool leaked personal identifying information to an “unauthorized third party,” according to the Washington School District.

In a letter sent to district families Monday, Washington Superintendent Willie Stone said the compromised data included sensitive information about students and staff.

“PowerSchool has unfortunately confirmed that data belonging to students and teachers within our district, and across the country, was impacted as a result of this incident,” Stone wrote. “PowerSchool has confirmed that some personally identifiable information … such as social security numbers, was impacted.“

Washington is just one of several schools hit by the breach nationwide, according to local news media reports in several states.

In a statement released Jan. 13, PowerSchool reported that the incident exclusively compromised data for its customers using PowerSchool SIS, one of its mainstay products offering cloud-based grade books, attendance tracking, demographic data and digital report cards, among myriad other services.

The company doesn’t believe the unauthorized party still has access.

“PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers,” it said in one FAQ page. “We have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.”

The company also said it mobilized a “cross-functional response team” after learning about the incident, with internal employees and “third-party cybersecurity experts” launching an investigation.

“We are working to complete our investigation of the incident and are coordinating with districts and schools to provide more information and resources (including credit monitoring or identity protection services if applicable) as they become available,” PowerSchool said in a statement.

Washington CSD plans to share updates from the company as they come in, according to Stone’s district-wide letter, where he said the “safety and security of all information concerning our students, parents, and staff is of the utmost importance to us.”

Asked about how many students and staff were affected at Washington, Stone said the district had no information to share as of Wednesday morning.

“While we appreciate and understand the questions we are receiving, PowerSchool and Washington Community School District have not yet completed the investigation of this incident,” he said in an email. “We are now working diligently with cybersecurity professionals to determine the precise data that was impacted by this incident, and we will provide notification to individuals as quickly as possible. We thank all parents, students, and staff for their patience as we work through this process.”

Comments: Kalen.McCain@southeastiowaunion.com