School districts in Hampshire County, including Amherst-Pelham Regional and Hadley, and across the country are taking steps to secure their data after a security breach at the widely-used, California-based software company PowerSchool meant unauthorized access to information stored in school systems was gained by a malevolent party, who held the information for ransom.

According to customer FAQs released by PowerSchool regarding the breach, the company became aware of “a potential cybersecurity incident involving unauthorized access to certain information through one of our community-focused customer support portals, PowerSource,” on Dec. 28.

The breach occurred between Dec. 19 and 22, with unauthorized access to some servers as early as Dec. 3. PowerSchool has not released the total number of districts or individuals affected by the breach.

PowerSchool has said in statements and communications to affected districts that the breach has been contained, and according to a statement sent by the Amherst-Pelham Regional School District — which uses PowerSchool — to students, parents and community members, “PowerSchool has taken responsibility for the breach, paid the ransom, and received assurances that the stolen data has been deleted.”

School districts such as Amherst-Pelham use PowerSchool to store and manage district data. Data that was accessed included student names, addresses, dates of birth and state IDs, PowerSchool login credentials, medical alerts, names and contact information for parents and teachers, and more.

At Amherst-Pelham, the Social Security numbers of 12 former students were stored in the system as an anomaly, and these were compromised as well. District officials have removed all Social Security numbers from the system and reminded all staff that this information should not be stored in the system.

In the Hadley School District, which also uses PowerSchool, bus stop data, transcript information, ID photos and demographic information were accessed.

However, PowerSchool stated in its FAQ that it has not experienced, and does not expect to experience, operational disruptions due to this complication, and there is no evidence that any malware or continued unauthorized activity are present in PowerSchool.

Hadley Superintendent Anne McKenzie attended an informational meeting held by PowerSchool on Wednesday, during which the PowerSchool CEO shared that the hacker provided video evidence that the data was deleted and provided assurances that no copies were made beforehand. PowerSchool also engaged with Crowdstrike for dark web monitoring as an additional precaution, and it was shared that PowerSchool platforms in the United States and Canada were attacked, not individual districts.

McKenzie shared these takeaways from the meeting in an email to parents and community members that day.

Additionally, McKenzie said in an email to the Gazette that PowerSchool “has indicated that they will follow up with those affected by the breach and provide identity protection and credit monitoring.”

However, based on the information that Hadley has received from PowerSchool at this time, McKenzie said there are not currently further concerns about data security.

In the Amherst-Pelham School District, immediate measures have included disabling PowerSchool’s access to servers, resetting usernames and passwords, and removing Social Security numbers from the system.

“In addition, we are providing training for staff on data security best practices and monitoring all systems for any signs of unauthorized access,” said Amherst-Pelham Superintendent Xiomara Herman in an email to the Gazette.

In addition to resetting login credentials, Herman said that members of the district are being asked to monitor credit reports and financial accounts for unusual activity, and said that updates and guidance will continue to be made available by the district.

When asked how this incident may have impacted the district’s relationship with PowerSchool, Herman said that Amherst-Pelham will keep using the service, though under a watchful eye.

“At this time, we are continuing to work with PowerSchool as it is an integral part of our student information management system. PowerSchool has taken responsibility for the breach and has provided assurances about the steps they are taking to prevent future incidents,” said Herman. “While we appreciate their transparency and cooperation, we are carefully evaluating their response to ensure that it aligns with the expectations of our district and community. Any decision about future use of PowerSchool will be made with careful consideration of their ongoing actions and our security needs.”

In an effort to prevent further breaches, PowerSource said in their FAQ that they are working to strengthen password policies and controls “including increasing password length and complexity requirements.”

PowerSchool expects to have a finalized forensic report available by Jan. 17.

Alexa Lewis can be reached at alewis@gazettenet.com.