RALEIGH — PowerSchool, the data system used in North Carolina to track student information and grades, reported a data breach that occurred near the end of December.
PowerSchool is used by 55 million students spanning 90 countries worldwide, including all K-12 students in North Carolina.
Schools and districts received an email from PowerSchool on Dec. 28 informing them of a data breach in the PowerSchool Student Information System (SIS) that stores and manages student records, grades, attendance, enrollment and personally identifiable information such as names, addresses, medical information and even Social Security numbers.
PowerSchool reportedly paid an undisclosed ransom to the hackers to prevent data from being released.
“Rest assured, we have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse,” PowerSchool wrote in the Dec. 28 email to its clients. “We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination.”
In an email statement to North State Journal, a PowerSchool spokesperson confirmed the Dec. 28 intrusion date and said the company is not experiencing any disruptions in service.
“As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts,” the PowerSchool spokesperson wrote. “PowerSchool is committed to protecting the security and integrity of our applications. We take our responsibility to protect student data privacy and act responsibly as data processors extremely seriously.”
The company also said that “some personally identifiable information (PII), such as social security numbers (SSN) and medical information, was involved” and that PowerSchool is “working with urgency” to identify individuals whose data may have been compromised.
“We care deeply about the students, teachers, and families we serve and are wholeheartedly committed to supporting them,” wrote the PowerSchool spokesperson. “We are working to complete our investigation of the incident and are coordinating with districts and schools to provide more information and resources (including credit monitoring or identity protection services if applicable) as it becomes available.”
North Carolina Department of Public Instruction (NCDPI) Deputy Communications Director Jeanie McDowell told North State Journal the agency received an email from PowerSchool about the incident on Jan. 7.
“PowerSchool has shared that the threat has been contained and that the compromised data has been destroyed,” McDowell wrote. “Both PowerSchool and independent security consultants have also confirmed that there were no actions that NCDPI or any NC Public School Units could have taken to prevent this global cybersecurity incident.”
McDowell also said NCDPI is in “continuous contact” with the state’s school districts and that “protecting student and educator data is a top priority, and we take this matter very seriously.”
NCDPI later issued a formal statement to North State Journal that said a “limited number of student social security numbers were exposed, specifically less than 1,000 students’ social security numbers were in the data from the 12 years PowerSchool administered North Carolina’s student information system.
“More teachers’ social security numbers were impacted than students. PowerSchool is analyzing the data and has shared that they plan to begin the notification process by the end of January.”
NCDPI said the agency is “advocating with PowerSchool on behalf of North Carolina’s students and educators to ensure timely notification and appropriate actions, such as credit monitoring.” A link to the N.C. Department of Justice’s free credit freeze information was also included.
PowerSchool is typically deployed on a district-by-district basis. North Carolina is unique in that all 115 districts in the state use and are connected to the system.
The decision to use PowerSchool statewide was made in 2012 under former State Superintendent June Atkinson. The State Board of Education finalized a policy change in 2013, moving from the former system, called NC WISE, to PowerSchool. Issues arose in implementing PowerSchool statewide, which lasted up through 2016 and impacted the use of the system.
According to the State Board of Education February 2022 meeting notes, the most recent PowerSchool contract was described as lasting “for 2 years with an option to extend for a third year in the amount of $29 Million.”
During its Nov. 2, 2023, meeting, the State Board of Education voted to replace PowerSchool with Infinite Campus starting on July 1, 2025.
PowerSchool was originally owned and operated by Pearson, one of the largest education materials and textbook companies in the world. Pearson sold PowerSchool to Vista Equity Partners in 2015 for around $350 million. In June 2024, Bain Capital acquired PowerSchool for $5.6 billion.
