Expand / Collapse search
☰

Cybersecurity breach exposes data of thousands in suburban school districts

By FOX 32 Digital Staff
Published  January 10, 2025 7:23am CST
Data Breaches
FOX 32 Chicago

The Brief

    • A cybersecurity breach involving PowerSchool, the Student Information System for District 39, exposed data for over 16,000 students and 3,000 staff members after a hacker accessed the account of a PowerSchool employee in December 2024.
    • The exposed information includes names, addresses, and contact details but does not include Social Security or driver’s license numbers.
    • PowerSchool and District 39 are investigating the incident and implementing additional security measures to prevent future breaches.

WILMETTE, Ill. - Wilmette Public Schools District 39 announced Thursday that a cybersecurity breach involving its school information system has compromised data for approximately 16,000 current and former students and 3,000 staff members. 

The breach was part of a larger attack affecting many of the 18,000 school districts using PowerSchool globally, according to Tony DeMonte, District 39's Assistant Superintendent for Technology and Safety.

PowerSchool reported the breach occurred between Dec. 19-24, after a threat actor gained access using the compromised account of a technical support employee. 

The exposed data includes student names, ID numbers, addresses, birthdates and contact information for parents and guardians. Staff data such as names, ID numbers, employee type, and school email addresses were also accessed. District 39 confirmed that Social Security and driver’s license numbers were not compromised, as these are not stored in the PowerSchool system.

PowerSchool has assured customers that it believes the stolen data has been deleted without being replicated or made public. The company has engaged cybersecurity firm CrowdStrike to investigate the breach, with a final forensic report expected by Jan. 17. In response to the incident, PowerSchool has updated employee credentials and restricted access to its support tools.

"PowerSchool will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations. The particular information compromised will vary by impacted customer. We anticipate that only a subset of impacted customers will have notification obligations," PowerSchool officials said in a statement.

District 39 emphasized its commitment to protecting personal information and is reviewing its data security practices. The district is also working with other impacted districts and leveraging support from educational technology organizations to strengthen protections.

Mundelein High School District 120 reported they were also impacted by the data breach.

Further details about the breach and the district’s response are available here.

To read PowerSchool's full statement on the data breach, tap here.

Data BreachesWilmetteNewsEducationTechnology