PowerSchool Breach Coverage Shows Why K-12 Vendor Access Needs Tighter Controls

Public reporting on the PowerSchool breach has kept K-12 vendor access in the spotlight. Cybersecurity Dive reported in January 2025 that districts were publicly disclosing exposure after PowerSchool alerted customers to unauthorized access to Student Information System data.¹ Other reporting said the incident involved stolen credentials and broad access concerns.²

For districts, the lesson is not limited to one vendor. Student information systems are among the most sensitive platforms in the K-12 environment because they can contain student demographics, family contacts, grades, schedules, attendance, health flags, discipline records, and staff information.

Why SIS vendor access is different

A student information system is not a normal SaaS application. It is a district operating system. When support portals, vendor admin accounts, integrations, or exports are over-permissioned, the potential exposure can reach years of student and employee records.

Districts often rely on vendors for support, updates, migrations, and reporting. That access may be necessary, but it should be tightly governed.

What districts should review now

K-12 IT teams should review:

• vendor support portal accounts
• MFA requirements for vendor and district admins
• export permissions and bulk data controls
• API integrations and service accounts
• stale or shared accounts
• logging and alerting for unusual exports
• contract terms for breach notification and evidence sharing
• parent and staff communication workflows

This work belongs in both the technology plan and the student data privacy program.

Datapath perspective

The hardest part of vendor governance is that responsibility is split. Curriculum, student services, business offices, and site teams may each sponsor applications. IT may be asked to secure systems it did not select. Legal may not know which integrations are active.

District leaders should create one shared vendor-access review process for systems that touch student or staff data. It does not need to be complex, but it must be consistent.

What to do next

Start with the top five systems holding the most sensitive student data. For each one, identify admin users, vendor users, support access paths, export rights, API tokens, logging availability, and breach notification terms.

Then set a quarterly access review. In K-12, vendor risk changes every semester as staff, students, applications, and integrations change.

Footnotes

1. Cybersecurity Dive, “PowerSchool data breach possibly exposed student, staff data” ↩

2. TechCrunch, “Malware stole internal PowerSchool passwords from engineer’s hacked computer” ↩