PowerSchool SIS data theft through a compromised support-portal credential
PowerSchool told customers on January 7, 2025 that an attacker had used its PowerSource customer support portal to reach and export data from customers' PowerSchool student information system (SIS) instances. CrowdStrike's investigation, published in March 2025, found the actor entered PowerSource with a single compromised credential and held access from December 19 to December 28, 2024, and that the same credential had also been used to access PowerSchool's network between August and September 2024.
- Victim
- PowerSchool
- Industry
- Education
- Country
- United States
- Intrusion began
- Dec 19, 2024
- First disclosed
- Jan 7, 2025
- Actor
- Financially motivated
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A support portal with maintenance access into every customer's SIS was protected by a reusable credential. Phishing-resistant MFA and network restriction on vendor support access, plus alerting on bulk exports, would have narrowed the blast radius.
Sources
- PowerSchool Cybersecurity Incident, PowerSchool, Mar 7, 2025
- PowerSchool Portal Compromised Months Before Massive Data Breach, SecurityWeek, Mar 12, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
- Advance Auto Parts job applicant data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). PowerSchool SIS data theft through a compromised support-portal credential. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-powerschool-powersource-credential/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.