Fake PowerSchool / Infinite Campus / Canvas / Blackboard / Schoology / Aspen / Skyward / ClassDojo parent-portal breach lure — "your child's grades / attendance / IEP records will be locked, verify within 24 hours" targeting US parents of 50M+ PowerSchool + 9M Infinite Campus + 30M Canvas students; parent credentials + student SSN + DOB harvest enables child identity theft (undetected for years until student applies for college loans)
fake-parent-school-portal-breach-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake "your child's PowerSchool / Infinite Campus / Canvas / Blackboard / Schoology / Aspen / Skyward / ClassDojo parent portal has been accessed — verify your identity within 24 hours or your child's grades / attendance / IEP records will be locked" email targeting US parents of K-12 and college-bound students. PowerSchool alone serves 50M+ students across 90+ countries; Infinite Campus 9M+; Canvas 30M+; Blackboard 20M+. The combined parent-facing surface is 80M+ US parents. Attack shape exploits DEEP parental anxiety — the threat framing (child's grades / attendance / disciplinary records at risk) triggers click-without-hesitation. Harvests parent portal login + parent SSN (used on enrollment forms) + student SSN + DOB + address + guardian phone. Post-compromise: child identity theft is especially valuable because it goes UNDETECTED FOR YEARS — children don't check credit reports until they apply for college loans or their first credit card, at which point attackers have had a years-long head start. The 2024 PowerSchool breach (62M student records) primed the mental model: parents received real breach-notification emails and are now trained to react to the pattern. Fires when body references PowerSchool / Infinite Campus / Canvas / Blackboard / Schoology / Aspen / Skyward / ClassDojo / parent portal / student portal / school district portal / IEP record AND contains security-incident / breach / grades-locked / attendance-at-risk / verify-identity urgency. Excludes powerschool.com, infinitecampus.com (+ .org), instructure.com, canvaslms.com, blackboard.com, schoology.com, aspenmb.com, skyward.com, classdojo.com, seesaw.com, classroom.google.com, plus `.edu` / `.k12.us` / state k12 school-district umbrellas. Auto-classified as danger via the `-lure` suffix.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started