In early January 2025, education software giant PowerSchool disclosed a breach that, by the attacker's own count, reached more than 62 million students and over 9 million teachers across North America. The entry point was mundane: a compromised credential for a customer-support portal, which attackers reportedly used as early as August 2024. Stolen data included names, addresses, dates of birth, and in some districts Social Security numbers and medical details.
There was no exotic exploit here. One reused or phished password on a support login opened the door to sensitive records held on behalf of thousands of schools.
For a small or mid-size business, this is the whole ballgame in one story. Turn on multi-factor authentication everywhere, especially on admin and support portals. Know exactly what customer data your vendors hold and how they protect it, because a breach at your provider becomes your problem and your notification obligation. Ask vendors plainly how they enforce MFA before you trust them with anyone's data.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard