National data breach impacts multiple Lorain County schools

Multiple school districts in Lorain County were affected by a nationwide data breach of the cloud-based student information system PowerSchool, including Elyria, Lorain, Oberlin, Columbia and Firelands. The California-based company, which provides administrative software to thousands of school districts across North America, alerted districts on Wednesday that it had been the victim of a data breach. The administrative software is used to track student data, grades and provides a platform for communication between parents and faculty. According to information provided to multiple districts, the data breach occurred on Dec. 28 when the hacker contacted PowerSchool and threatened to release the information if the company did not pay a ransom. PowerSchool paid the ransom and said the data had been deleted. The FBI is now investigating the hack. The cost of the ransom has not been released. Elyria Schools sent an alert to parents on Wednesday night, warning them of the data breach and providing them with the latest information. An email message from Amy Higgins, the district's marketing and communications director, told parents that the breach had affected "certain staff and student records." "PowerSchool has indicated that they believe the information has not been shared," Higgins said in the email. "They (PowerSchool) paid a ransom to the data extortionists and were then provided reasonable assurance that the data was destroyed and is no longer accessible to the public." One thing that is known about the breach is that it originally targeted at PowerSchool itself, not any individual school or school district. For districts that were affected, there is still a lack of clarity on what information was accessed. PowerSchool can record personal information for students and faculty such as address, demographic information and even a Social Security number. Elyria Superintendent Ann Schloss said that the district is still waiting to learn more about the breach, but Elyria does not record or maintain any student Social Security numbers within its PowerSchool system. It does not appear that any Lorain County schools had Social Security numbers that may have been exposed. Schloss apologized to parents for the sparse information, saying that the district was in the same position and would provide new information when possible. "I just want (parents) to know that we are in touch with the authorities and doing what we need to do to investigate on our end what exactly happened," Schloss said. "We're kind of waiting to hear from (PowerSchool), we're a little bit at the mercy of them in some of this. We will keep parents posted as we get new information." Several districts told The Chronicle that their districts utilize PowerSchool, but they did not believe any of their student information was included in the breach; those include Avon, Avon Lake, North Ridgeville, Midview, Clearview, Amherst and Keystone schools. "I want to assure you that this breach did not impact Midview Local Schools in any way," Midview Superintendent Frank Major said in a letter to parents. "Our district has worked closely with our internal technology team and Connect (our technology partner) to confirm that all Midview data remains secure and untouched." PowerSchool did not respond to a request for further information from The Chronicle. According to multiple districts, parents and faculty have not been asked to update any passwords on PowerSchool. Contact Owen MacMillan at (440) 329-7123 or omacmillan@chroniclet.com.