PowerSchool hit by by Salesloft Drift campaign, but hackers claim that there is no risk of harm or ransom

PowerSchool was among the victims of the Salesloft Drift/Salesforce campaign attributed to Scattered LAPSUS$ Hunters, with the organisation noting in a post in a closed users group that, on 23 August, it was affected by a security incident involving the Drift app and that a threat actor gained unauthorized access to the Salesforce database used for customer support and internal case management.

The affected data reportedly includes customer contact information, support case metadata, and the contents of support case communications, while no evidence suggests other PowerSchool infrastructure or production systems were compromised. The attackers’ main motive appears to have been credential theft, according to published information on the incident by Salesloft, and PowerSchool advises reviewing any credentials in support cases and changing them.

As part of its communications, the security team emphasised not sending credentials to vendors in support cases. according to PowerSchool Security Team, ShinyHunters has claimed not to target PowerSchool and to have deleted the data, with correspondence indicating there would be no further ransom demands.