Summit Public Schools breach exposes student and staff records

Who is affected

A hacker has published 115 GB of data from Summit Public Schools, a network operating in California and Washington. The files include information on students, staff, alumni and possibly parents. Hackread, the only outlet to report the breach so far, identified about 21,000 email addresses in the leaked data, but this does not represent the total number of people affected. The files cover several campuses and include records from as far back as 2018.

What was taken

The leaked data includes full names, home and mailing addresses, dates of birth, gender, ethnicity, student identification numbers, and enrolment details. Some records also list graduation years, transfer notes, and administrative comments. Student account usernames and password fields appear in the files, but the passwords are not readable, and it is unclear if they are current or usable. The collection also contains historical data, such as old enrolment records and transaction timestamps from 2021. Alumni contact details and internal school records are included as well. While the hacker claimed to have medical information, Hackread did not find any real medical diagnoses or doctor contact details in the reviewed files.

How the attack worked

The hacker, using the name Sp1d3yG0nz4l3s, claimed to have breached Summit’s cloud environment in October 2026 by exploiting a critical vulnerability. They posted the data on a hacking forum on 22 October. The attacker said the vulnerability was patched about an hour after they contacted the school, but did not provide technical details or a CVE identifier. The files are organised into folders labelled for PowerSchool (a student information system), Clever (an education platform), and Salesforce (used for alumni records). The exact method of entry and the vulnerability used remain unclear.

The response

Summit Public Schools has not made a public statement about the breach, and there is no confirmation from the organisation or authorities. Hackread recommends that anyone who receives suspicious messages referring to these records should verify requests directly with their school, especially if asked for passwords, payments or more personal information.

What you should do

If you are connected to Summit Public Schools as a student, parent, staff member or alumnus, be cautious of emails or calls that reference personal or school information. Do not share passwords or payment details in response to unexpected requests. Contact your school directly to confirm any communication that seems unusual or asks for sensitive information.

Only Hackread has reported this breach so far, and Summit Public Schools has not confirmed the incident. The number of people affected and the full extent of the data exposed are not yet clear. The technical details of the vulnerability used in the attack have not been disclosed.