JAY — A software breach doesn’t seem to have affected Regional School Unit 73, directors were told at their meeting Jan. 9.

“Some of you may have heard already … Power School, which is the student information (software) system where we keep all the courses and the student information and teacher information as well, it’s a huge database,” Chris Hollingsworth, curriculum and technology director said. “I think at last count probably about 90% of schools in Maine use Power School so it’s very popular in Maine. They had a cyberattack on Power School itself and there were several schools in Maine that the attacker got in and either had access or could pull out actual information, whether it be student names or numbers.”

Hollingsworth said the district does not keep Social Security numbers in Power School but it does have addresses. “The letter we received (from Power School) said that during their investigation it didn’t look like we were actually broken into. I think they are a little overwhelmed right now so I had Mark Bonnevie, our technology support, look into it, look into some log files and dig a little deeper into our Power School to see if anything looked suspicious. He did find a couple of our log files that don’t look quite right.”

It isn’t known if somebody did get in, so to be safe a case has been opened with Power School, log files will be sent and they will be asked to look deeper and let the district if it should be something to be worried about or not, Hollingsworth said. “We do want to know if for some reason somebody did get some information out. We would want our parents to know that. If for some reason they said that they were wrong and it did look like somebody might have gotten into our system then we can let everybody, let parents know.”

Hollingsworth stressed Power School at this point is saying nobody has accessed district information.

The district is lucky as most things have been moved to cloud based, he said. “Cloud based does help because it’s not technically on our servers,” Hollingsworth said. “We just don’t have the capability to be able to have enough firewalls, enough protection if somebody really wanted to get in, to get into one of our servers.”

Advertisement

Gmail is cloud based, Hollingsworth said. “Power School is actually cloud based. In this case they were trying to break into Power School, not our servers. Our business software is all cloud based and they have a lot better protection than we could ever give. It’s one of the reasons we moved to cloud based to make sure that kind of information is protected.”

On Jan. 10 the Press Herald reported at least nine Maine school districts were affected by the Power School software breach. According to the article, Power School’s software, the most-used student information platform in the United States, serves 50 million students across the country. On Jan. 8 PowerSchool informed clients nationwide that their data may have been compromised in the cybersecurity breach, it noted.

“I heard this on the news this morning, a couple of schools in New Hampshire had been hit,” Director Andrew Sylvester of Livermore said. “When they hack in what damage can they do, have they done?”

“I think we would want to take responsibility for letting people know if for some reason somebody did get in and pulled some information out,” Hollingsworth replied. “Liability would probably lie with Power School since it was their servers broken into.”

A student’s or more likely staff person’s name, phone number, address email address could be obtained, Hollingsworth said. “It’s mostly contact information that is in that system that they could possibly pull out.”

Director Michelle Moffett of Livermore Falls asked if student’s disability or medical information and individualized education plans are in Power School.

“IEPs have a flag in there that they could pull up,” Hollingsworth said. “That would be a little more difficult to pull up because it’s not directly in the database. It’s like an attachment, but it is still there so it could be a possibility.”

Jenna Cote, Section 504 and special services director responded that no IEPs, doctor’s notes or similar items are attached. What is attached are the accommodations educational modifications or supports to help students with disabilities, she added.

Join the Conversation

Please sign into your Sun Journal account to participate in conversations below. If you do not have an account, you can register or subscribe. Questions? Please see our FAQs.