There’s been another breach involving student and teacher data stored on PowerSchool software, State Superintendent of Public Instruction Mo Green said at a Wednesday evening press conference.
“It is completely unfortunate that the perpetrators are preying on innocent children and dedicated public servants,” Green said. “We are working closely with law enforcement to try to do everything we can do to be sure that the responsible parties are held accountable for their actions.”
School districts use PowerSchool to track student enrollment, attendance, and other data. In January, the company said it suffered a “global breach” that involved decades worth of data from hundreds of school districts in the U.S., Canada, and other countries. The breach exposed Social Security numbers of about 312,000 North Carolina teachers some 900 K-12 students.
At the time, PowerSchool assured educators that all the affected data had been destroyed. But this week, Green said, “threat actors” reached out to affected school systems to demand ransom for the data.
“The North Carolina Department of Public Instruction has not and certainly will not engage with these threat actors,” Green said. “We are prohibited by law from doing so, as well.”
Vanessa Wrenn, DPI’s Chief Information Officer, said about 20 local education agencies received ransom emails. She said those messages “showed some evidence of having the same data that was breached in January. We are working with those schools, and we have also set up a way for schools who receive any other notification to reach out to us as well.”
However, Wrenn and Green said it’s not clear if the same attackers are responsible for both incidents.
According to NBC News, PowerSchool paid the hackers to view a video that purportedly showed the data being destroyed. It’s not known how much PowerSchool paid for the video or if there was any secondary verification of the destruction.
“As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us,” the company said in a statement.
Green said the state is ready to end its relationship with PowerSchool when its contract ends this summer. North Carolina schools will transition to a platform known as Infinite Campus, beginning July 1.
