{
  "type": "bundle",
  "id": "bundle--ecc23059-f119-5d5b-808f-5c15e6fe066a",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--0fa151d9-87bd-5674-824c-21ab5f808939",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:d25ac25e-0f51-57c3-828d-14f0917d45a9",
      "name": "PowerSchool",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--0e1b19f9-e84a-5076-80c7-d4622956b0cc",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:fc635f55-8cd4-5fa3-8902-8ef5fcb25d15",
      "name": "PowerSchool security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--59a8cb0f-5d3e-56fe-844f-f101012faa4f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:2c1e0790-6c95-57b6-a45f-fc36a9a92258",
      "name": "PowerSchool security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0ab2b2a2-e1e2-544d-8bcc-c881a686f57e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:da11a1e4-4663-5d2c-8869-db1b612ae8a7",
      "relationship_type": "affected-organization",
      "source_ref": "incident--59a8cb0f-5d3e-56fe-844f-f101012faa4f",
      "target_ref": "identity--0fa151d9-87bd-5674-824c-21ab5f808939",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:2822fc73-02c6-5665-9a87-2ebab5a5c7c9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0f37560c-c5a3-5cfd-8c40-33dde6a17196",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:d302069d-b59d-56a0-81b7-7b51bf1f10f2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:fe80ffad-282c-5b09-a340-7f3dc0569b1e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-01-08"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1c1ab4dc-be23-58b3-8fe6-0da6d5d17955",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f9cf7fc9-daa6-5b5d-ae89-adbeee20771d",
      "confidence": 87,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:79bc101b-2df5-5b7e-ab5a-4b4417d246f5",
          "description": "- The PowerSchool company’s post‑breach remedial actions focused on: Deactivating the compromised credential and restricting all access to the affected portal; Additional confidential measures that increased security were undertaken. - The Department of Education and Early Childhood Development conducted a full password reset and further tightened password and access control for all relevant accounts; Additional confidential measures that increased security were undertaken. - The Department of Education and Early Childhood Development and OCIO will be implementing recommendations as per the OIPC report.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Compromised support-portal credentials, no MFA."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--46374e24-b43e-55dd-8875-8db1d1cca488",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2da12613-b0f7-5095-b0c1-336da06fdc50",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:f6066667-f14a-522d-b2d3-8e48302f17d9",
          "description": "February 20, 2025: PowerSchool sent an email to students and educators, confirming the name of the impacted person, types of personal information exfiltrated in the breach, and provided details on how to access credit monitoring and identity protection services (Office of the Information and Privacy Commissioner Newfoundland and Labrador, 2026).",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source reports that identity or credit monitoring was offered to affected people."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6c311e0e-cf62-596b-8d2e-d879d6d74dd4",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:963a3ccf-a907-5733-8718-0586ae9da335",
      "confidence": 85,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:8ab71313-18f7-555b-82dd-6354aa004a59",
          "description": "However, PowerSchool paid a ransom after receiving assurances and purported evidence from the threat actor that the stolen data would be destroyed.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Data on tens of millions of US/Canadian students and teachers stolen; PowerSchool paid the extortion demand, then individual school districts were re-extorted with the same stolen data months later."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bd3c0fa0-e01b-54f7-8762-5b5d6528bae4",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b12dcbc2-67b9-5007-90e9-e167ca0dded2",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:be5658fa-1d09-5239-a097-ff32918ea742",
          "description": "Information contained in Rycor was not accessed in this cybersecurity incident.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f3e4f14e-eca1-5926-8894-3f97ee62720a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:0e877940-bdca-5b94-b62e-06a0904b6554",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Government of Newfoundland and Labrador",
          "url": "https://www.gov.nl.ca/education/powerschool-cybersecurity-incident/",
          "external_id": "cit:32825bae-704c-5fba-9bae-e69dc31ce1df",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2649169d1eff40c3f3eecc70ed9f820954523bc54fb41e7583f93bff87e8450d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the powerschool security incident involving PowerSchool."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--7a241244-c5a1-583a-8107-96ef02a572e0",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:85f92df7-8f2e-5d51-9637-c5721a78d03b",
      "name": "Documented public update"
    }
  ]
}