PowerSchool Cybersecurity Breach: What You Need to Know

Live from the we don't know this is a special episode studio. This is the K-12 Tech Talk podcast. Like I said, this is a special episode. We're kind of doing this on the fly. This is some news that broke over the last two days, and we decided that we needed to do a special episode. My name is Josh. I'm a K-12 Tech Director in Missouri. Chris is with me. Hello, Chris.

Hey, what's up?

He is a K-12 Tech Director from a school district in Missouri. And then the oddball, the guy who's out of place here, the one who doesn't, one of these things isn't like the other. Mark, he was a CIO, and he's apparently really cold tonight because he is bundled up. He is a consultant in the K-12 realm helping school districts manage IT. Yeah, we won't get into that. But yeah.

Something.

Yeah, something. Something happened. So should we just jump right into the meat of the...

I think we have to. Yeah.

We were recording this on January 8th yesterday, about 24 hours ago. PowerSchool sent a letter out to all of their customers, and their customers got one of two letters. They both said there has been a cybersecurity incident. One of the letters said, you are not impacted, And the other one said, you are impacted. And as you can imagine, the Internet just imploded at that point with everybody standing up and saying, I got the letter. What does this mean? What the heck is going on?

Yeah, it's not like a Willy Wonka letter where, you know, you want the golden ticket. You don't want.

Nobody wants the ticket.

Nobody wants the golden ticket from PowerSchool.

No, no. So PowerSchool announced that they released an FAQ with some some details yesterday along with that letter. And then today and tomorrow, January 8th and January 9th, they held or holding webinars to give more details into it. So... Um, one of my clients is a school district that uses PowerSchool and got the bad email. Um, so I was able to attend, uh, the webinar. We're going to be, we talked about this ahead of the show. We're going to be really careful with what we talk about here.

And the investigation, because they said multiple times this is still an ongoing investigation with the employees.

Yeah, yeah. So we're going to be reporting on what has been publicly reported as of this moment. And I'm sure we'll be talking about this one for weeks to come. But yes, PowerSchool was the recipient of a cyber attack. Let's call it what it is. And they did use the phrase today on the webinar that this was a cyber attack. And a number of school districts were impacted. That number, as of right now, we don't know what that number is.

So, yeah, so I saw a post that estimating that a third of the public school or a third of the districts in the country use PowerSchool. Do you think that's a fair assessment?

I thought it was more, so I'll go for a third.

Yeah, it's about actually I have the data. It's about a third of the school districts use PowerSchool. They are the most popular SIS in the country, and it looks like this attack was only on PowerSchool's SIS. So even though PowerSchool has a host of other products, it was only the SIS that was impacted by this attack.

Um, something else, Mark, we're going to step through. You wrote a, I jokingly called it a manifesto, um, but a seems to be rather popular LinkedIn article, uh, about this. Uh, you've got some main talking points and we're going to kind of step through those talking points. You want to do that now? Yeah. Or, okay. Yeah. Um, so the first one, power school, isn't just an ed tech company.

Yeah, on their website, they do say that they serve about 60 million students. Unsure if that's 60 million students with their SIS and also unsure if that's 60 million students impacted by this incident. I would assume it's a whole lot less, but I think from what we're seeing on forums and both Reddit, the K12 sysadmin forum has been very active, and then K12 Tech Pro has been extremely active as well.

And quick, quick plug for both the subreddit K12 SysAdmin and K12 Tech Pro. It wasn't real long yesterday afternoon. Shortly after that email was sent out, you started seeing IOCs being published over on K12 Tech Pro from very like these folks that are running PowerSchool that were able to look through their logs and pick out the IOCs. Like needle in a haystack, brilliant kind of actions.

Do you know it's a big deal because the posts on K-12 SysAdmin and on K-12 Tech Pro are just, they're massive.

Yeah.

And just constant comments going on. And if you can use comments as a measuring tool to the impact, it's a really big deal what's going on right now.

So I live in Boston and the Boston Marathon bombing was a big deal. And at that time, Reddit became this massive like underground detective agency of trying to figure out who the bombers were for good and bad. They're mostly bad. There was a few people innocently charged. But that was exactly what happened in the last 24 hours is somebody had posted on Reddit. it and kudos to this person, like a huge Google doc of how to find the logs within your Power School instance.

So that was point number two in your manifesto is this is a data. This was a data exfiltration attack of epic proportion. So if you couple that with the user base that we're assuming, the most popular sys in the country, and then data exfiltration probably scripted to hit, just knowing the number of schools over on Pro and the number of schools on K-12 sysadmin that said their data was taken, like, that's not a single person doing this, click, click, click. That had to be a script.

Yeah, it was very mechanical. And so either you have a group of people going from customer to customer within PowerSchool and downloading it, or you have a script that's downloading these specific, these two tables over and over again and over again. It was also done during the holiday break. I'm pretty sure that's going to be intentional as well.

Yeah. Yeah. I was talking with somebody in my office today, just kind of walking through this timeline and this story. And it's like every damn holiday, I leave the office and think, is this the holiday it happens? Is this we're going on an extended break? Is this when it's going to happen? And of course, I walk in over Christmas break and I have a UPS feeling in my data center. I thought that was going to be the big story of Christmas break. Little did I know.

Yeah, yeah. So it does, you know, more of the timeline has come out. It does look like the first instance of this compromised account. By the way, this was a compromised account that's been confirmed by PowerSchool in their letters. The first instance of it being used was December 19th. So that's pretty much when school districts are starting to close for the holiday break. It was used subsequently over the next few days while everybody was out.

Yeah, I know in Missouri, DESE told us to stop collecting them. Shoot, that had to be eight years ago, nine years ago. OK, but I will say teacher social security numbers are part are part of state reporting. So we have to collect those on the student information system. So it would be interesting. I think the teacher social security number out of the teacher table would be a higher incident rate than the student social security number being with that data being exfiltrated.

Okay.

And in Missouri with like we have like Medicaid, like health stuff, whatever, you still have to pull those numbers. So, again, I guess you would hope that it wasn't tracked in PowerSchool.

Yeah.

But there still are cases that I'm sure many states have where you still in smaller ranges, but have to pull those socials in.

Yeah. I think overall, this was limited to two tables, likely two tables, the student and the staff teacher account or teacher tables. So it's a smaller subset of data than we've seen in other attacks. But the breadth of this was much, much larger than we have ever seen.

And still very, very valuable data.

Correct. Yeah. But we're not seeing in some of the targeted school district accounts or attacks, you've seen reports and psychology and behavior type stuff. That's not likely going to be a part of this breach. But the number of school districts is exponentially larger than any attack we've seen in a long time.

This this so probably would be the largest besides the Pearson I don't I don't remember how large the Pearson one was years ago yeah but yeah this is going to be massive comparative yeah

The third thing is how they got in. And this was a hard one. I think this is where I'm going to be very careful with my words because we've had some people talking about this information publicly online. PowerSchool was, and to their credit, this is where I'll give massive kudos to PowerSchool for their webinar. They were extremely transparent with what happened and how it happened to the best of their ability.

I didn't get that vibe

Yeah i think that's that's undetermined right now uh and and that's probably could be very part of the of the investigations why we don't know the details of that one but i know i kind of left with a few questions around how did this account get compromised and what security options were in place. And PowerSchool did reference some of the changes that they're making to lock that down in the future.

That's one thing, you know, when you were saying the good thing is that giving PowerSchool kudos during the webinar, I don't think they answered, I dropped, but I don't think they answered a single question with, we can't talk about that. Did they? Yeah.

Um, I don't believe so.

I don't believe so. No, I mean, in a webinar covering this type of content and this type of event for a vendor, the vendor that was breached, not to more or less roll over and answer every question with we can't talk about that. It's an ongoing investigation. Yeah, like that's that alone is a major kudos. Like they actually answered questions with with pretty damn good detail.

Yeah, yeah. I mean, that takes leadership. The CEO started that call.

If you operate from the timeline of they didn't find out until the 28th, and then they sent an email out notifying all their customers with accurate information as to whether or not they were affected on the 7th, you're talking less than 10 days for them to operate a response, contract out CrowdStrike to a response to figure out, do some data forensics. And then correlate that data out in contact. 10 days? Really, you're upset about 10 days. Yes, I agree it's not a good, it's a bad situation.

Yeah, in the grand scheme of things, the scope and scale of this incident and the information that we have received in that amount of time, it is commendable to see. We would always love to hear more about when you find out, But I think the other frustrating part is if you were to tell us on December 28th, A, you're in the middle of the investigation, and it sounds like they're – we're going to get to this in a second. They're also in the middle of discussing this with the attackers.

Yeah.

Yeah if that was that first email you got the golden ticket one yeah stuff's hacked we don't know yet

Yeah yeah don't ask we don't know the answer is gonna be we don't know just don't ask yeah

Yeah so so yes um there was a a unauthorized party uh that had accessed their systems they they were aware of this on december 28th and they notified people about it was.

That like a unauthorized Christmas office party.

Yeah, yeah.

Those are the best,

Man. Yeah, yeah. So, um, I don't know. I think, I think, timelines are really, really hard, especially when you're in it.

Well, and comparatively, other breaches in recent history, we're talking 90 days later and getting a notification of a breach, you know? Yeah, yeah. Come on.

Yeah.

And let's factor in that it was on holiday.

Right. Yeah. Like you sound European on holiday.

Well,

I mean, I.

Think some people came into work for this.

Probably got paid overtime.

There are some people that were off that were called in.

I'm still waiting to find out what the heck happened with CrowdStrike. So, you know, here we are seven months later.

Oh, no, that's real.

There goes that CrowdStrike sponsorship.

So yeah and then the last one and this is i i think this is the one that hurts the most power school did pay uh the attackers uh they did say that this was not a ransomware incident this is where i was a little confused they did say that this was not a ransomware institute but they did pay i think what they mean by that is the attackers did not uh hold systems hostage, but there there was discussion of the data being posted or released publicly and power school or their representatives

And i was going to say they did get something in return they got a video of the shred command being used on the data. Now,

I know logic, logic.

Logic would say, what is there to prove that they didn't make a copy of that data already, you know, in, you know, honor among thieves. And I know there's this kind of undertone trend of, well, these guys are in a business and they don't want a bad reputation in the business world of doing the things they say they're not going to do if they get paid.

I think this the the the quote was received reasonable assurances but like what is that

Right and

Like that's that's a relative thing to me like what's reasonable for you might not be reasonable for me i still think you got a jump drive in your pocket

Yeah yeah or yeah yeah

Yeah yeah that's a that's a hard one and i i'm gonna withhold any sort of comment on that one just because i don't i don't i don't know.

Enough slam slam your beverage and get tell us what you really feel mark come on uh no

I i don't know i mean i i think i i.

Hope it plays out the way they expect it to play out that that every intention of this conversation is i hope power school is correct and it is not leaked but man that takes a whole lot of trust um yeah yeah Yeah. I don't know. Yeah.

Or a whole lot of money.

Yeah. But I mean, yeah, I don't know. I would and maybe we won't ever really find this out. I would like to know the number of districts affected and what that student count is.

Yeah.

Compared to like other ransom. Shoot, there was a district just, there was another article last week. A district confirmed to pay $1.5 million to get their data, to not release their data. So 1.5 million for a single district. And we're talking the largest CIS in the country, potentially millions of students. What is that number?

Yeah, I don't want to know. I don't want to know. I don't want to know the answer to that question.

Mark, they did confirm that they paid?

Yes. Yeah, that was confirmed. That was, in fact, I believe that was confirmed in an article on TechCrunch. They had confirmed that one. So, yeah, so those those are kind of the main learnings of the power school instance so far. Just kind of a quick pivot. What if you are impacted school district?

So, yeah, great question. I'm sure each of us, the three of us have had conversations over the last 24 hours with districts. Yeah. You know, hey, we got notification. We were affected. I talked to a friend this afternoon, last evening and this afternoon, that it was just time for him to give a board report. And he was going to inform the board of that, of this incident. Okay, Mark, you likely have had to deal with something similar to this before. Chris and I haven't.

Well, at this point, everything is public. And so, yeah, I'm working with a school district that has impacted this one. So, you know, my advice is to start communicating to families and to your board as soon as possible. And this is where I think as a school district, your parents are going to want to hear from you, the school district.

PowerSchool was going to offer some of that, some templates, right? Yeah.

Yeah. I think they did say to their school districts on the call that they're going to be helping a little bit with that one. But I will say this.

At least they can do is offer an email template.

It it is it is your as a school district it's your responsibility to notify your your your district.

Your well and their and state department of educations like this is a brief dust off that breach notification process protocol yeah local laws like your your time your clock is now ticking for breach notifications to the state as well if that's to desi or if that's to some other office at the state level, your state CISO or somebody like that.

Yeah. Yeah. So that's the first thing I would be doing right now is, is, is communicating to your, your families, um, as tech directors, we should be aware of what data was likely contained in the student and the, and the teacher table, um, and communicating that, uh, to your leadership as well.

I don't think that question we quick had about the social security numbers thing, like, hey, did we have that or not? We don't think we did. Figure that out. Go figure that part out.

Well, and that's a conversation that should not be happening during an incident either. You should have an idea or a data dictionary somewhere of what data like that is kept where.

That's the TechCrunch article cites the bleeping computer article, but it says PowerSchool said could have social, could have medical, could have grades, could have pi that same paragraph says power school did not say how much the company paid but anyways could have so figure out if your system does or doesn't

Yeah yep

And that's that's the nature of an sis.

So mark and customize it so in that communication to parents are you leaning on the fact that you have a data privacy agreement with power school and that you know you you as a district and as the IT leader, did your due diligence of making PowerSchool prove that they adhered to a standard NIST, CIS, something along those lines, were protecting the data Do you communicate that fact to your parents? Does it hold water with parents? Are parents going to care that you had a DPA?

I think that's a great question. I think it all depends on your community and what you know is important to your community. When I was in the Boston Public Schools, that was less important than the community next door to us who felt that data privacy and data privacy agreements were extremely important. So I think it all depends on the community that you're in. You write the letter that meets the needs of your community and you say what needs to be said.

But I think I like it. spicy mark come on

No no no i mean not in that way but this is the time for you to build trust back in absolutely in your vendors and in in your school district and i don't think throwing power school under the bus to your family to your community is the right move because let's be clear we're not all kind of just abandon power school move to another sis you're going to be using this system tomorrow and the last thing that you need is families not trusting the system and not trusting you for using that system.

But devil's advocate here, just to press that point of not throwing anyone under the bus.

Yeah.

Because you do have to maintain that relationship with PowerSchool going forward. But the likelihood of them seeing your letter to parents is probably pretty small.

You could move to campus.

Yeah, don't. Yeah. Do you sort of take the defensive in your letter to parents saying, look, we selected PowerSchool as a vendor because they are top tier.

Yeah i think i think that's something that you can do i i think more important to that one is to, underscore the fact that this was an attack that this was not the district acting uh you know, maliciously or or incompetently the cavalier this was you know at this point we don't think that the vendor was necessarily being cavalier. There's still a lot to be determined, but this was an attack. This was not somebody that just left a thing open for somebody to get.

I think, you know, listening back to our ransomware interviews, that's one of the comments, I think it was the LAUSD interview that we did, he, during their communication process with their constituents and their parents, they were very clear and beat that drum of, we were attacked. This was a deliberate attack. Yeah. I think that carries, that phrasing carries an amazing amount of weight and meaning when people read that and really take a second to understand what that means.

And PowerSchool can say that same phrasing, and it kind of hits you a little bit different, for sure.

Yeah.

I was just pulling up, reminding myself, PowerSchool did sign the White House Secure by Design pledge, I guess.

They did.

The pledge didn't quite make it all the way, but you still pledge.

They were at the White House, and we weren't.

Anyway.

Listen, I also pledged to go to the gym every day.

I pledged to do dry January, and I didn't make it two days. Yeah.

No, the other thing I was thinking through, I mean, for us in the tech role, what else can we be doing at this point? I think right now it is about communication, both to and from PowerSchool and then to and from your families. From what I learned on the webinar, from what I read online, I don't think there's much technically that we could be doing right now to close this up. No. There has been some very strong voices around like, well, some districts were

Yeah.

Given how this came out, we won't go into the details of that one on the podcast, but given that's how this came out, I don't think there's anything that a school district can do to prevent that from happening. And there's really nothing that you can do outside of communication right now. But what I will say is I always never let a crisis go to waste. And if you have not rolled out two-step verification, this is your time.

Well, I took this as an opportunity. I took the bleeping computer article and forwarded it to my superintendents this morning and said, hey, look, we're not a PowerSchool school. This doesn't affect us. But you need to know, like, this is the big dog. And it happened to them. We could easily be in this same boat due to any one of the other hundreds of third parties that we use for ed tech services. In a very similar event. This is very, very real.

Yeah.

So if you're not a power school school, I, I would be at least informing your central office staff about the, you know, forward them the bleeping, the bleeping computer article or the tech crunch article, um, and kind of scare them.

Ooh, what else is there to say right now about this?

Uh, I think this was a good special episode. If you want to know.

I don't feel good about it.

Well, if you want to know some of the things that are in between the lines that we're not talking about, go over, check out K12 sysadmin over on Reddit. But there is some really meaty content over on K12 Tech Pro. You just hit community and click join. Take a sponsored option. You don't have to pay to join. Take the sponsored option. Chris is going to shoot me dirty looks for saying this. Take the sponsored option. You can get in for free.

Yeah, that's what... And I posted this on... So we mod the K12SysAdmin subreddit. It is great. But it is public, right? So as we're digging in, like this post, you're digging in the logs. You're kind of showing some cards.

Are some damn smart people yes on there

We're going to post Mark's article on Pro kind of as we do this episode out. And we're going to tag up these articles that we've talked about too. And like that log, Google Doc is a great document if you haven't checked out your PowerSchool stuff yet.

Yeah, there's a user on Reddit who posted a Google Doc with instructions on exactly how to verify and look at your audit logs. It's really, really well done. And every time I've gone in there, there's at least 30, 40, 50 people in this document. So excellent job.

So if you are a PowerSchool school and you got any solace or any actionable content out of this episode, please share us with other PowerSchool schools or even schools that aren't PowerSchool. We hope you got some decent content out of this. You're not alone in this breach. You're with a number of districts, probably the majority of the districts in the country, it sounds like, working through this.