Central Ohio school districts find themselves entangled in the tentacles of a global data breach following an intrusion into the systems of PowerSchool, an education software company widely employed across the region. The cyberattack impacts at least seven local institutions, including Westerville City Schools, Grandview Heights Schools, Olentangy Local Schools, Canal Winchester Schools, Delaware City Schools, New Albany Plain Schools, and Upper Arlington Schools. These schools have been notified by PowerSchool of the breach, as reported by WBNS.
Bob Carver, a cybersecurity expert, highlighted school information's vulnerability to cybercriminals, who told WBNS, "All it takes is a threat actor to find one problem, one vulnerability, and take advantage of that vulnerability. Then, they’re in and they can have access to the information." The breach highlights the susceptibility of even closely guarded academic environments to unauthorized access. According to the U.S. Department of Education, Carver also emphasized the value of a single student record, which can fetch between $250 and $300 on the black market.
PowerSchool swiftly responded to the data breach, "As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts." In hopes of quelling the concerns of those affected, the company has assured its commitment to security, privacy, and responsible data processing, a sentiment reiterated in its public statements and communicated by FOX28.
Under the looming specter of misuse of private data, Carver advises that affected parents and students should take protective financial measures. "Go to Equifax, TransUnion and Experian and place a no cost credit freeze on both the student and parent," he recommended during a WBNS interview. Most school districts involved have made it clear that social security numbers are not stored through PowerSchool and have been reassured by the company that the accessed data has been deleted and should not be shared publicly.
.jpg){kind=link}