PowerSchool (SIS)

PowerSchool Data Breach Incident Statement

On the afternoon of Tuesday, January 7, PowerSchool alerted North Carolina public schools and the North Carolina Department of Public Instruction (NCDPI) to a cybersecurity incident impacting student and teacher data across their global client base. This incident was not isolated to North Carolina; it impacted PowerSchool clients globally. PowerSchool is a student information system (SIS) that has been in use in North Carolina since 2013. 

On December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized access to student and teacher data. The data breach occurred when the credentials of a PowerSchool contract employee were compromised. The threat actors used the compromised account to download student and staff data tables from schools around the world.

PowerSchool has shared that the threat has been contained and that the compromised data was not shared and has been destroyed. PowerSchool is working with law enforcement to monitor the dark web for any data exposure.

As the party responsible for the breach, PowerSchool will conduct all necessary notifications once the investigation is completed to ensure appropriate and accurate compliance with local, state and federal requirements and laws. PowerSchool has informed all impacted Public School Units (PSU). All PSUs that currently or previously utilized the PowerSchool SIS were impacted by the data breach to some degree. A limited number of student social security numbers were exposed, specifically less than 1,000 students’ social security numbers were in the data from the 12 years PowerSchool administered North Carolina’s  student information system. More teachers’ social security numbers were impacted than students. PowerSchool is analyzing the data and has shared that they plan to begin the notification process by the end of January.

Both PowerSchool and independent security consultants have also confirmed that there were no actions that NCDPI or any PSU could have taken to prevent this global cybersecurity incident.

NCDPI is working closely with PSUs across the state to identify the specific information accessed at each school and to support students and staff throughout this process. We are also advocating with PowerSchool on behalf of North Carolina’s students and educators to ensure timely notification and appropriate actions, such as credit monitoring. NCDPI remains committed to providing guidance and resources to help affected individuals stay informed and receive the necessary support as we work to address the impact of this incident.

1/22/25 Update: On January 17, PowerSchool announced that they had contracted with Experian, a trusted credit reporting agency, to offer identity protection and credit monitoring services to all students and educators whose information was involved in the PowerSchool SIS data breach.

This offer is being provided regardless of whether an individual’s Social Security number was exfiltrated.

•  Identity Protection: PowerSchool will be offering two years of complimentary identity protection services for all students and educators whose information was involved. 
•  Credit Monitoring: PowerSchool will also be offering two years of complimentary credit monitoring services for all adult students and educators whose information was involved. 

In addition, PowerSchool has shared that the plan to begin issuing notifications to involved individuals and relevant state attorney general offices in the next two weeks.

2/5/25 Update:PowerSchool has begun the process of providing formal, legal notice to current and former students (or their parents/guardians as applicable) and educators whose information was exposed in the cybersecurity incident in December. These notifications will come from Ps-sis-incident@mail.csid.com.

They will reach out to those for whom they have sufficient contact information, and they have also issued global notifications, such as their website and media outreach to ensure they reach as many involved individuals as possible. 

In addition, the credit monitoring and identity protection services through Experian have gone live. Information about these services is available on their website, and Experian will distribute a direct notification to impacted individuals as well.

Additional Information and Resources

• PowerSchool FAQ
• PowerSchool Resource Site: Notification and Credit Monitoring and Identity Protection Services Information
• NCDOJ: Free Security Freeze in North Carolina
• PowerSchool Direct Contact: Megan Veverk
• Additional FAQ (1/17/14)

About PowerSchool

PowerSchool is the official student information system used statewide by the public and charter schools of North Carolina for storing and managing student data. It maintains over 1.5 million student records and provides robust capabilities for educators and administrators to effectively manage school processes.  PowerSchool reinforces personalized learning by offering the ability to tailor a student's instructional path with his or her interests, skills, and goals.

One of its many great features is the Parent Portal which gives parents and students access to student grades and assignments online. This information is also available through the Parent Portal App for those on the go!  

Need to contact PowerSchool leads in other PSUs? Click on the PS Public School Unit Contacts button below.

Public School Unit Contacts for PowerSchool Support