Press play to start listening
A hacker has leaked 115 GB of Summit Public Schools data containing billions of lines, student and staff personal records and approximately 21,000 email addresses.
Names, home addresses, birth dates, phone numbers, parents details and school records of thousands of students and teachers are among the 115 GB of Summit Public Schools data published on a hacking forum.
Hackread.com examined the collection and verified that it contains personal information associated with the school network, including historical records and student account fields.
The files appeared on PwnForums on October 22, 2026, posted by an account using the name Sp1d3yG0nz4l3s. The account claimed to have breached the organisation’s cloud environment and described the release as approximately 100 GB, saying it was part of a larger collection. Hackread.com’s review puts the available files at 115 GB and identified approximately 21,000 email addresses.
Summit Public Schools operates schools in California and Washington. Although the forum post introduces Summit Tamalpais, one campus within the network, the released files include California and Washington school exports, education-service records and alumni information.
Personal Information and Historical School Records Exposed
Records examined by Hackread.com contain full names, dates of birth, residential and mailing addresses, gender, ethnicity, student identification numbers and enrollment information.
Some entries also include graduation years, transfer comments and administrative records. Student account usernames and populated password fields also appear in the collection. The reviewed password values are not readable plaintext, and their format and current usability remain unclear.
The files also contain older information, including enrollment entries from 2018 and 2019 and transaction timestamps from 2021. Separate person records list internal identifiers, active-status flags, creation and modification dates and the names of people who last changed entries.
Taken together, the files contain billions of lines, according to Hackread.com’s analysis. That total includes repeated entries that have not been removed, so it cannot be used as a count of individual records or affected people. The approximately 21,000 email addresses likewise should not be read as a victim total.
However, with names, birth dates and addresses available together, criminals could use the information to impersonate school employees or send convincing messages to students, parents and former students.
PowerSchool, Clever and Salesforce Exports Included
The collection is divided into folders labelled POWERSCHOOL_CA, POWERSCHOOL_WA, CLEVER and SALESFORCE_SUMMITPSALUMNI.
Within the California PowerSchool folder, TEACHERS.csv and USERS.csv are listed at 15.82 GB and 8.06 GB. The Washington folder contains six exports covering students, teachers, users, people, email addresses and telephone numbers.
Its largest file, STUDENTS.csv, is 35.12 GB, followed by PERSON.csv at 13.89 GB, while student and teacher exports in the Clever directory are organised under six education-service names, including:
- Khan Academy
- Lexia Core5 PowerUp
- MyLexia
- Newsela
- NWEA
- ST Math
The files also include alumni account and contact records in a Salesforce folder, with the two exports measuring 46.90 MB and 92.68 MB. The hacker used Salesforce and Snowflake hashtags in the forum post but did not explain how either platform was involved. No separate Snowflake folder appears in the listing.
Previously, ShinyHunters hackers breached the Salesforce environment of Instructure, the company behind the Canvas learning management system used by schools and universities worldwide, through social engineering in September 2025.
A separate Canvas breach in May 2026 involved its Free-for-Teacher environment, not a Salesforce flaw. No connection between those incidents and the Summit release has been identified. bitdefender.com
Hacker Claims Access Through a Critical Vulnerability
According to the forum account, an unspecified critical vulnerability allowed access to Summit’s cloud environment in October.
The poster said the weakness was patched an hour after the organisation was contacted, but supplied no CVE identifier, supporting correspondence or technical explanation.
Many files carry October 22 timestamps, although the collection includes information dating back several years. The date of the forum release therefore does not identify when the records were taken.
Claims of Student Medical Data Remain Unverified
The account also claimed to possess students’ medical conditions, descriptions of those conditions and assigned doctors. Records reviewed by Hackread.com contain medical-alert and doctor-contact fields, but the examined medical-alert entries were empty. One doctor entry contained an uncertain response and an apparently placeholder telephone number. Genuine diagnoses or doctors’ contact details have not been verified.
Nevertheless, the published material leaves students, families and employees facing exposure of personal information while the affected campuses and number of individuals remain unresolved.
Anyone receiving messages referring to these records should verify requests directly with their school, particularly requests for passwords, payments or additional personal details.
