Some Southern Colorado school districts affected by data breach

COLORADO SPRINGS, Colo. (KRDO) - Several Southern Colorado school districts have been affected by a data breach involving PowerSchool, an education technology software platform.

KRDO13 has reached out to many local school districts, some have gotten back to us, and some have not, at the time of this writing. Not all districts use PowerSchool.

District 49

District 49 provided the following statement:

"PowerSchool, the provider of School District 49’s student and workforce information management system, notified our district late this week that D49 is included in a significant breach of PowerSchool’s cybersecurity.  This is profoundly troubling news for D49, as we place the utmost importance on protecting student data. We are diligent in ensuring that student information is handled with care and security, and we are working closely with PowerSchool to monitor and address the situation.  District 49 is collaborating with our cybersecurity specialists and with PowerSchool to constrain the current breach and prevent future breaches while we ensure that PowerSchool provides appropriate protections and monitoring services to those affected by this event. 

The district said the following data was impacted:

• Workforce Notification:  Name, Address (affected one person), Date of birth (DOB), Ethnicity, Gender, Work email and telephone number that the staff member released for weather alerts, PowerSchool/ PowerTeacher Pro login (only username), EDID (Educator Identification), Assigned school, Job Title
• Parent Notification: Name, Addresses, Lunch Status, Date of birth (DOB), Medical Information, Ethnicity, Gender, Grade Level, Cumulative  GPA, Parent's information, including email and telephone number, Emergency contact information, including email and telephone number, PowerSchool login (only username)

The district also said, "While PowerSchool reports that student Social Security Numbers (SSN) were accessed during the breach, School District 49 has reassured parents that D49 does not record or store student SSN in our system, so there is no possibility that SSN from our stakeholders were accessed."

District 11

District 11 was impacted and is still working to clarify what data was compromised.

The district's senior executive director of IT provided the following:

"We are committed to keeping you informed about matters that impact our community. We were recently notified by PowerSchool, the vendor for our Student Information System (SIS), of a cybersecurity incident that affected certain information belonging to our students and teachers. While the investigation is ongoing, here is what we know so far:

• On or about December 22, 2024, a PowerSchool contractor account was compromised and used to access some data related to our students and teachers. Notably, we did not store Social Security numbers in our SIS; therefore, no student or teacher Social Security numbers were impacted in connection with this incident.
• User accounts, passwords, and other sensitive credentials were not compromised, and there is no need for staff to change passwords.
• PowerSchool’s other systems, as well as all other District 11 systems, were not impacted by this incident.

PowerSchool has assured us that the situation is contained. They are working with leading cybersecurity professionals from CrowdStrike to conduct a thorough forensic analysis and ensure ongoing monitoring.

While PowerSchool continues to assess the full scope of this incident, we want to reassure you that the safety and security of our students, families, and staff remain our highest priority. We appreciate your patience and understanding as this investigation continues, and will provide updates as more details become available.

Thank you for your trust and understanding as we work through this situation."

Chavez Huerta Preparatory Academy

A representative of Chavez Huerta Preparatory Academy (CHPA) in Pueblo provided the following statement:

"We have just recently found out about the data leak and awaiting more details from our PowerSchool account manager. I do know that we were assured a quick response and resolution of the incident via email. We haven’t received details of what data was leaked other than student/staff names, addresses, and demographic information.  I can say that we do not house Lunch status.  We house emergency contact phone numbers, no addresses, etc. and we do house the rest of the information you listed below, but no confirmation has been received by us from PowerSchool with details of the data in the leak."

The school also said that CHPA does not house identifiable information such as social security numbers, banking info, or credit information, and most of the data will be names and addresses.

The school said they do house the following information:

• Student/Staff Names, addresses, and demographic information
• Emergency contact phone numbers
• DOBs, Student Medical Information, EDID, GPA, Staff Assigned Schools & Job Titles, Power school usernames

District 70

Parents in District 70 received the following message from district administration:

"Dear Parents and Staff,

This letter is to inform you of a recent data security incident involving PowerSchool, the company that provides our student information system.  PowerSchool experienced unauthorized access to its customer support portal, affecting its customers worldwide. The unauthorized access was gained using a compromised credential. 

PowerSchool has informed us that the accessed data relates to families and educators who use their student information system. Information provided indicates that the taken data primarily includes parent and student contact information with data elements such as name, date of birth, lunch status, and address information. Across their customer base, they have determined that for a small portion of individuals, some personally identifiable information (PII), such as social security numbers (SSN) and medical alert information, was impacted. PowerSchool assures us they are addressing this situation with utmost seriousness and are committed to supporting affected customers. They also have assured us that the data compromised has been deleted without any further replication or dissemination.  They have taken the following steps:

●    Deactivated the compromised account.
●    Conducted a full password reset and strengthened password and access controls for their customer support accounts.
●    Notified law enforcement.
●    They have no evidence of malware or continued unauthorized activity in the PowerSchool environment. 
●    PowerSchool will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations
●    Powerschool has taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. They do not anticipate the data being shared or made public, and they believe it has been deleted without any further replication or dissemination
●    Powerschool expects to have a finalized forensic report by January 17th 
●    Additional Information: Powerschool Public Statement and Community FAQ’s
●    If you have additional questions, please contact Powerschool at 877-873-1550

While PowerSchool believes that the accessed data will not be shared or made public, we encourage you to remain vigilant and monitor your accounts for any suspicious activity.  We understand that this news may be concerning, and we want to assure you that we are committed to protecting the privacy and security of our students and staff. We are working closely with PowerSchool to determine the specific impact of this incident on our district. As Powerschool shares more information with us, we will provide further updates as they become available.

Thank you for your patience and understanding."

KRDO13 is still waiting to hear back from the following districts on whether they use PowerSchool and if they were impacted:

• D14
• Canon City Schools

KRDO13 has confirmed the following districts were not impacted:

• D20 - Does not use PowerSchool
• D38 - Does not use PowerSchool
• D2 - Does not use PowerSchool
• D3 - Does not use PowerSchool
• D8 - Does not use PowerSchool
• D60 - Does not use PowerSchool
• D12 - Does not use PowerSchool
• Fremont School District Re-2 - Does not use PowerSchool