A few months after Hacked Educational Software Maker PowerSchool paid a hacker ransom to remove a bank of stolen student data, at least one school district says it is being forced by someone who said the data has not been destroyed.
PowerSchool provided K-12 software to thousands of schools to support 60 million students across North America, and was hacked in December 2024 using one stolen credential.
The company said at the time it paid hackers a ransom that allegedly deleted stolen data, but repeatedly refused to disclose the amount they paid.
The Toronto district school board, which now serves around 240,000 students each year, said earlier this week that it “received communications from threat actors who used data from previously reported cases to claim ransom.”
Several other schools in North America received a memo of fear tor, including North Carolina, by local media.
Powerschool confirmed it had paid the ransom at the time, and said the company “thought it was the best option to keep the data from being published.”
Some cybersecurity experts and law enforcement agencies have long discouraged victims from paying ransom because there is no guarantee that hackers will stick to their words when they claim to delete stolen data. It was later discovered that some gangs often retain a large amount of stolen victim data to deny the affected individuals with additional terror attempts, as evidenced by past ransomware and tor incidents.
In a statement shared with customers this week, PowerSchool, seen by TechCrunch, said, “We recently noticed that threat actors contacted some PowerSchool SIS customers in an attempt to force data from a December 2024 violation.”
Powerschool spokesman Beth Keebler told TechCrunch he doesn’t think this is a new incident, as “the data samples matched the data stolen in December.”
Powerschool has not yet stated how many individuals will be affected by a data breaches. Several districts that used PowerSchool during the violation told TechCrunch that “all” of historic student and teacher data was damaged
For Toronto school districts, stolen records date back at least to 2009 and can affect millions of people.