Crime does pay. It’s the motivator behind ransomware and extortion scams and why the PowerSchool breach (in which data for millions of students was lost to a hacker) is now dragging out further. Late last week, affected school districts in locations like Toronto and North Carolina began sharing reports of new extortion demands. No one is spending money, and you should take the same approach to your kids’ data.
Why? If you fork over cash once, you’ll likely have to keep shelling out.
As disclosed in its incident summary, PowerSchool already paid the attacker to delete the data, in an attempt to minimize the damage of its December security breach. But in these recent communications, targeted school districts received proof that the hacker still had the information. (You can read more of the details in TechCrunch’s rundown.)
At this point as a parent, you can do little to keep that info from leaking. It’ll depend on the temperament of this particular hacker, but if PowerSchool’s money wasn’t enough, a bunch of public schools won’t be able to afford silence, either. Nor any individual families, were it ever to come to that.
Instead, you should focus on how to block misuse of leaked data. For a kid caught up in the PowerSchool fiasco, these are the key steps to take on their behalf:
- Sign them up for PowerSchool’s offer of two free years of identity protection and credit monitoring. (US residents | Canadian residents)
- Freeze your kid’s credit reports.
- Request an IRS identity protection PIN for them.
- Freeze your child’s banking report.
For steps 2 through 4, I explain how to complete each task in an earlier article covering the PowerSchool breach. You can also refer to this CNET piece that details the author’s experience setting up credit freezes for her children.
Even if your family is only marginally affected by the PowerSchool breach, or not impacted at all, these steps are wise to take. The number of security leaks and breaches is accelerating. We everyday users can’t directly stop or prevent the onslaught, much less the spread of data afterward. It helps to know what info has spread to the dark web, sure. But you should keep cybercriminals from using the data to steal or exploit your family, too.