PowerSchool
A support portal without multi-factor authentication gave access to student records at schools across North America. (Source: TechCrunch)
The Privileged Access Blind Spot: Education
The largest breach of student data in US history took one stolen password and a support portal with no MFA. The incidents below share that shape: a campus is thousands of accounts changing every semester, and the ones that survive are the ones that get used.
Two pagesPublic reporting onlyFreeWritten by certified engineers
The incidents
Three breaches, one pattern
Stanford
An intrusion into one department's network that went undetected for more than four months, a dwell-time risk every large institution carries. (Source: Stanford Report)
Stale accounts and edtech vendors
Accounts nobody retired, and third-party education platforms with access nobody governs.
The read-across
What the pattern means for you
A university offboards a cohort every May. The accounts that outlive graduation, the departed faculty member still in the directory, the research collaborator whose grant ended — those are the access paths, and decentralized IT means nobody sees all of them.
Self-check
The 60-second self-check
- How many accounts belonging to people who graduated or left in the last two years are still active?
- Is MFA enforced on every portal that touches student records — including the ones departments run themselves?
- Who owns each research collaborator's access, and when does it expire?
- Does your financial aid system meet the GLBA Safeguards Rule controls an FSA audit checks?
- Could you produce a list of every administrator across every college system, today?
If any answer is "no" or "I would have to ask", that is the blind spot.
The full brief
Get the full brief
The two-page PDF adds the full account of each incident and the control that would have stopped it. Name and work email, and it comes straight back.
Next
Where to go next
The sector page: identity security for education. The service that closes the gap: IGA implementation. And a free audit is 30 minutes with a certified engineer on your own environment, findings in writing: Get a free audit.
Get the Education brief
Name and work email. The two-page PDF covers each incident in full and the control that would have stopped it.