Dear District 103 families and staff,
On the afternoon of Tuesday, January 7, 2025, our school district was informed by PowerSchool of a recent data breach within the PowerSchool Student Information System (PowerSchool SIS). This breach has had a global impact on its customers, including our district. I am writing to share the information we have at this time, and outline the next steps in our response.
We understand that situations like this can be deeply unsettling, as the privacy and security of personal information are matters of great concern. Please know that we are working with PowerSchool to better understand the scope of the breach and to ensure that appropriate measures are taken to safeguard the information. We will keep you informed of developments as they become available from PowerSchool.
Description of the Data Breach
On December 28, 2024, PowerSchool discovered that a threat actor (the person or group that caused the breach) had accessed personal employee and student information from customers worldwide using the PowerSchool Student Information System (PowerSchool SIS). The threat actor exploited the user account of a PowerSchool technical support employee, allowing rapid access to and download of records from an unknown number of schools and districts worldwide between December 19 and December 23, 2024.
Using instructions provided by PowerSchool, D103’s Technology Team identified that portions of approximately 6,754 current and former student, and 1,778 employee records were accessed, including information such as:
Students
Student names and ID numbers
Home Address
Date of Birth
Parent/guardian contact information
Dates of enrollment and withdrawal reasons
Limited medical alert information (e.g., allergies, life-threatening conditions)
Whether or not a student has an IEP or 504, but not the actual information from the IEP or 504
Free and reduced lunch status
Employees
Employee names and ID numbers
Department
Employee type
School email address (and some personal)
Home Address
School and home phone number
Although PowerSchool has assured us that they have received reasonable assurances that the compromised data has been deleted and that no additional copies exist, we remain vigilant and are leveraging all available resources to thoroughly assess the situation and strengthen the protection of our systems.
District 103 Data Security Measures
Our school district takes data security very seriously and has several robust measures in place to safeguard our systems:
Privacy Laws: D103 carefully follows all privacy law in order to protect the privacy and data of our stakeholders. Such laws include FERPA, COPPA, and SOPPA.
Two-Factor Authentication: All employee users must verify their identity with a second factor, such as a security key or text message authentication, in addition to their password.
Automated Access Management: Our PowerSchool server integrates with our Google domain to automatically remove access for employees who leave the organization or change positions.
Best Practices: We follow security best practices, including enforcing security updates, regular training for our staff, and system monitoring to prevent unauthorized access.
Regular Cybersecurity Audits: With the help of multiple consultants and agencies, we conduct yearly audits of our cybersecurity posture to look for opportunities to strengthen our defenses.
Next Steps in Response to the Data Breach
The Technology Team continues to review data, validate system configurations and assess any additional actions that may be necessary. We are collaborating closely with other impacted school districts and leveraging our membership in both statewide and national educational technology organizations to ensure we have taken every possible step in responding to the data breach.
PowerSchool has provided the next steps it is taking in response to this incident:
PowerSchool has engaged CrowdStrike, a third-party, cybersecurity firm, to investigate the breach. Their final forensic report is anticipated to be released at the end of next week and will provide a clearer understanding of the incident and its potential impact.
PowerSchool has implemented additional information security best practices requiring updated credentials for all employees, and restricting access to their support system tools.
In accordance with the Student Online Personal Protection Act (SOPPA), D103 has prepared additional contact information for the FTC and credit agencies.
We will continue to keep our community informed as we learn more about this incident from PowerSchool. If you have any questions regarding this incident, please utilize this online form.
Craig Chatham, Ed.D
Director of Technology & Assessment
