Data Security Breach Reported In Pennsbury Schools

FALLSINGTON, PA —The Pennsbury School District is dealing with a data security breach of its student information systems.

In an email to the Pennsbury school community Thursday, Schools Superintendent Thomas A. Smith and Technology Director Tim McCleary stated that there was a "data security incident" involving PowerSchool, the school district's third-party provider for student information systems.

On Tuesday, PowerSchool notified school officials of a data breach that has impacted many school districts across the country, including Pennsbury.

Later Thursday, school officials met with PowerSchool representatives to understand the impact of the breach.

PowerSchool reported that they are confident the data breach has been contained and that no data was misused, released to additional parties, or made publicly available.

What Happened

According to PowerSchool, their systems experienced unauthorized access from Dec. 19 through Dec. 22.

Once the breach was discovered, PowerSchool’s security team took action to disable access to their systems and contain the breach. They are also working with the cybersecurity company Crowdstrike to address these events. Law enforcement was also notified.

PowerSchool is actively continuing its investigation to prevent future incidents. Again, PowerSchool officials have stressed that they are confident that the data breach has been contained and that no data was misused, released to additional parties, or made publicly available.

What Information Was Involved

At this time, PowerSchool has shared that the affected data consists of the following student demographic information: names, student identification numbers, and grade levels. The following staff information was also affected: names and Social Security Numbers. Student Social Security Numbers were not impacted as we do not maintain them in PowerSchool.

What Pennsbury Is Doing

While the breach occurred within PowerSchool’s systems,Pennsbury school officials said they are committed to ensuring that it is fully addressed.

"We are notifying state and local officials, including law enforcement, of this incident," officials said.

In addition, nationwide consumer reporting agencies will be notified, as required by law. Those employees whose Social Security Numbers were included in this breach will receive, at no cost to them, credit monitoring services for 12 months and access to an independent credit report from a consumer reporting agency.

Students impacted by this breach will receive identity protection for minors at no cost. Additional information about these measures will be forthcoming, including how to opt-in and access these benefits. PowerSchool has assured the District that these programs will be provided at no cost to the District or any individual.

While the breach occurred within PowerSchool’s systems, school officials said they remain vigilant in safeguarding district data, including through the following measures:

• Utilizing multi-factor authentication for district accounts.
• Conducting regular security testing of staff email accounts.
• Monitoring PowerSchool’s response closely to ensure all necessary actions are taken.

School officials are also working directly with PowerSchool to ensure that the Pennsbury community receives all available information about this breach and will provide updates as new information becomes available.