PowerSchool breach worries parents, has Michigan districts eying next steps

• Many Michigan school districts use PowerSchool to manage student information
• The company confirmed it had experienced a data breach in late December
• School districts are sending emails to families to tell them if their data is affected 

Michigan school district leaders this week are notifying parents and pondering next steps following a data breach at a prominent education software company.

PowerSchool, a cloud-based system that keeps grades, schedules and more for 55 million students worldwide, discovered a cybersecurity threat on Dec. 28 and confirmed it publicly this week. 

The company has not revealed how many students were impacted by the breach. Districts from Ann Arbor to Kalamazoo this week began alerting parents of the situation.

That has many worried, including Lena Kauffman.

“I don’t want data about my children falling in the wrong hands and I don't necessarily trust these big corporations to keep this data safe,” said Kauffman, a parent of two Ann Arbor Public Schools students and one graduate.

Related:

• Signs of progress for Michigan students in math — but not reading — since COVID
• Not working, not in school: A push to reach Michigan's 'disconnected' youth
• Michigan 'lifelong education' department turns 1, touting growth in free pre-K, college

The website Bleeping Computer reports the company said the incident was not a ransomware attack, but did pay ransom to avoid the data from being released.

PowerSchool sent a letter to a school district in Georgia, according to a local news report, that states “we have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse.

“We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination.” 

Ann Arbor Public Schools Superintendent Jazz Parks told families Thursday she anticipates the district will have identified what data was accessed from its student information system by next week. The district will also update a frequently asked questions document as it has more information. 

Kauffman said on social media she hopes the local school board will address the breach at its next school board meeting. 

It’s unclear just how many Michigan districts and students use PowerSchool, which did not immediately respond to a Bridge Michigan request for comment.  

A Waverly Community Schools official told WLNS the district does its best to ensure it can protect students. Director of Teaching and Learning Chris Huff told the news station district student directory information is in PowerSchool but not Social Security numbers. 

At Napoleon Community Schools, southeast of Jackson, Superintendent James Graham said on Facebook the PowerSchool incident “did not impact our district data.” 

“PowerSchool has informed us that they have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse,” Graham said.