Incident Score: Analysis & Impact (MICHOTGOOPOW1779697543)

In this Rankiteo incident briefing, we review the PowerSchool breach identified under incident ID MICHOTGOOPOW1779697543.

The analysis begins with a detailed overview of PowerSchool's information like the linkedin page: https://www.linkedin.com/company/powerschool-group-llc, the number of followers: 159772, the industry type: E-Learning Providers and the number of employees: 3504 employees

After the initial compromise, the video explains how Rankiteo's incident engine converts technical details into a normalized incident score. The incident score before the incident was 745 and after the incident was 641 with a difference of -104 which is could be a good indicator of the severity and impact of the incident.

In the next step of the video, we will analyze in more details the incident and the impact it had on PowerSchool and their customers.

On 01 April 2026, PowerSchool (Naviance) disclosed Data Harvesting issues under the banner "PowerSchool Naviance Data Harvesting Lawsuit Settlement".

A lawsuit alleged that PowerSchool's Naviance platform embedded Heap, a third-party tracking tool, which collected sensitive student data including keystrokes, clicks, mouse movements, and private messages to counselors without consent.

The disruption is felt across the environment, affecting Naviance platform, and exposing Keystrokes, clicks, mouse movements, private messages to counselors, plus an estimated financial loss of $17.25 million settlement.

In response, moved swiftly to contain the threat with measures like Heap, Google, Microsoft, and Hotjar agreed to delete all stored student data, and began remediation that includes Settlement agreement to delete data and pay affected students, and stakeholders are being briefed through Notifications to affected students.

The case underscores how Settled (pending final approval), teams are taking away lessons such as EdTech platforms must ensure compliance with privacy laws and obtain explicit consent for data collection. Third-party tracking tools pose significant risks to user privacy, and recommending next steps like Implement stricter data collection policies, conduct regular audits of third-party tools, and enhance transparency with users regarding data usage, with advisories going out to stakeholders covering Notifications sent to affected students with settlement details.

Finally, we try to match the incident with the MITRE ATT&CK framework to see if there is any correlation between the incident and the MITRE ATT&CK framework.

The MITRE ATT&CK framework is a knowledge base of techniques and sub-techniques that are used to describe the tactics and procedures of cyber adversaries. It is a powerful tool for understanding the threat landscape and for developing effective defense strategies.