Lessons Learned from Major Educational Technology
Vendor Breaches
It appears that the beginning of a new year not only brings promise and optimism but often, news of a data breach. For example, in December 2021, Illuminate Education was breached affecting schools state-wide. In November/December 2023 New York was faced with the repercussions from a New York Therapy employee falling victim to a phishing incident and a Raptor Technologies vulnerability found by a researcher showing that Raptor failed to secure two data storage repositories in the cloud, making student data and other records accessible.[1] In December 2024, threat actors exfiltrated data from PowerSchool’s student and teacher tables affecting over 300 New York schools and thousands of schools in several countries.
PowerSchool has and will continue to provide educational agencies with “lessons learned” regarding mitigating the risk to our student’s data. Here, we discuss two often overlooked mitigation strategies: Data Destruction and Data Minimization.
1. Data Destruction. Both the PowerSchool and Illuminate breaches affected former customers. An educational agency’s contract and/or Data Privacy Agreement (DPA) with a vendor requires the vendor to securely delete/destroy the school’s data when the contract ends and is not renewed. Unfortunately, it is too easy for both the vendor and educational agency to forget about this requirement. Educational agencies need to be proactive. Remember to ask for a certificate of secure deletion that is notarized and signed under penalty of perjury. Your school attorney might thank you after an incident such as PowerSchool.
2. Data Minimization. Additionally, educational agencies should only collect, store and share student data that it needs to. When data is no longer needed it must be securely deleted. Educational agencies are required to use the State’s LGS-1 as their guide for determining how long records are to be retained. For example, some educational agencies that were maintaining data long-term, went into their SIS and eliminated student social security numbers, those that did not update their records had students’ social security numbers breached as well as additional student data.
Finally, PowerSchool taught us the power of working together in a crisis. When the news of the PowerSchool breach broke, everyone wanted answers right away and PowerSchool could not provide the specific information that educational agencies needed. As reported by TechCrunch, what started as a Reddit post by an affected customer in Dubai that contained step by step instructions to determine if schools were compromised, ultimately became multiple users providing additional tools and insights to help other affected schools.[2] There are never enough resources when confronted with an issue such as an educational agency’s SIS being breached, however one customer in Dubai created and published instructions, assisting schools all over the world, including New York. As well, many of New York’s educational agencies helped each other with information sharing so that the extent of the breach could be ascertained as quickly as possible. Aside from it being the law, people affected by the PowerSchool breach deserved to know as quickly as possible so that they could take precautions. Schools helping schools supports all affected New Yorkers.
[1] Education Week: A Massive Data Leak Exposed School Lockdown Plans. What Districts Need to Know
[2] TechCrunch: How Victims of PowerSchool's Data Breach Helped Each Other Investigate 'Massive' Hack
| 
