UPDATED: PowerSchool Cybersecurity Incident and Data Breach
February 4, 2025 Update:
PowerSchool and Experian have started sending out information about enrolling in Experian's identity protection and credit monitoring services. PowerSchool has posted a notice of data breach and instructions for enrolling in complimentary services on their website. View the notice and instructions here.
The services being offered by PowerSchool and Experian to individuals impacted by the data breach are now active and available. Impacted staff and students may begin signing up for the services right away, even if they have not received correspondence from PowerSchool or Experian. Guardians may enroll underage students in a special Experian product for minors.
The deadline to enroll in Experian's complimentary services for adults or minors is May 30, 2025. To sign up, follow PowerSchool's instructions. View the instructions here.
PowerSchool Notice & Instructions
January 24, 2025:
PowerSchool is a cloud-based software vendor that the North Carolina Department of Public Instruction chose as a student information system provider. Caldwell County Schools and other districts throughout the state used PowerSchool. CCS administration has been working diligently to understand and assess the scope and severity of the cybersecurity incident so that we may accurately inform you of how students and staff may have been impacted.
The North Carolina Department of Public Instruction (NCDPI) informed Caldwell County Schools on Tuesday, January 7, 2025 of a cybersecurity incident that occurred in the PowerSchool Student Information System on December 28, 2024. The incident impacted school systems nationwide, including many in North Carolina, and involved a data breach. Caldwell County Schools was one of many school systems impacted by the data breach. At the time of the first notification, limited details were available.
PowerSchool contractor credentials were compromised, which led to the data breach. Caldwell County Schools does not own or maintain the security of the NC PowerSchool instance. There is nothing that Caldwell County Schools could have done to prevent the compromised credentials or data breach. PowerSchool has shared that the threat was quickly contained, the data was not shared, and the data has been destroyed. PowerSchool has assured Caldwell County Schools and other impacted districts that they will continue working with law enforcement and actively monitoring the web for any data exposure.
Since being notified, Caldwell County Schools has been gathering additional information about the scope and severity of the data breach. According to NCDPI and PowerSchool, the incident is contained, but Caldwell County Schools staff and student information was accessed. Caldwell County Schools discontinued use of the PowerSchool Student Information System in late June 2024, but older data was accessed in the breach.
Caldwell County Schools administration has worked with PowerSchool and NCDPI to gather, review, and assess the information involving Caldwell County Schools staff and student data that was included in the breach. After assessment, Caldwell County Schools administration determined sensitive information of some previous and current students and staff was accessed in the breach.
Student names, parents’ names, addresses, phone numbers, and dates of birth were accessed.
Staff names, dates of birth, social security numbers, addresses, and phone numbers were accessed.
Again, PowerSchool has shared that the threat was quickly contained, the data was not shared, and the data has been destroyed. PowerSchool has assured Caldwell County Schools and other impacted school districts that they will continue working with law enforcement and actively monitoring the web for any data exposure.
PowerSchool has shared that, in response, all students and staff whose information was involved will be offered:
- Identity Protection: PowerSchool will offer two years of complimentary identity protection for all students and staff whose information was involved.
- Credit Monitoring: PowerSchool will also offer two years of complimentary credit monitoring services for all adult students and staff whose information was involved.
PowerSchool will coordinate with Experian to offer these services. PowerSchool and Experian will send notifications and instructions regarding identity protection and credit monitoring. Once notices are distributed, Experian will provide a call center to answer questions.
Caldwell County Schools is serious about protecting the security and privacy of all data. To add an extra layer of protection to student information system accounts and district technology, it utilizes security measures such as two-factor authentication and active threat monitoring, and staff participates in regular cybersecurity training.
We understand this incident is frustrating and concerning. We will continue to monitor the situation and work with PowerSchool and NCDPI to ensure you are informed of any further steps you may need to take.
Resources:
Experian Guide to Freezing Your Credit Report
Federal Trade Commission Information on Credit Freezes and Fraud Alerts
NCDOJ: Security Freeze for Adults
NCDOJ: Security Freeze for Children/Minors
NCDOJ: Lifting a Security Freeze
Contact:
Caldwell County Schools will share relevant additional information as it is received. The PowerSchool Information Page can answer many questions. If you have additional questions, email CCS administration at contact@caldwellschools.com.