NC student data compromised in breach, NC and PowerSchool say
By Emily Walkenhorst and Destinee Patterson
Click here for updates on this story
North Carolina (WRAL) — Data from the North Carolina’s student and teacher information system — containing personal and private information about the state’s schoolchildren and teachers — was compromised last month, but officials say it has been destroyed.
PowerSchool notified the North Carolina Department of Public Instruction of the breach at about 2 p.m. Tuesday, according to Jeanie McDowell, a department spokeswoman. That was 10 days after the company says they discovered the breach — Dec. 28.
“NCDPI is aware of this issue and is actively working with PowerSchool to obtain more information,” McDowell wrote in an email to WRAL News. “Protecting student and educator data is a top priority, and we take this matter very seriously.”
McDowell said the breach occurred when the credentials of a PowerSchool contract employee were compromised and that compromised data has been destroyed.
PowerSchool told the agency the “threat began” Dec. 19 and was discovered Dec. 28.
A PowerSchool spokesperson told WRAL News that company had taken “all appropriate steps to prevent the data involved from further unauthorized access or misuse. The incident is contained and we do not anticipate the data being shared or made public.”
It’s unclear what data was made available during the unauthorized access.
PowerSchool is the state’s hub of essential student data. Beyond names and birthdates, it holds information on grades, disciplinary actions, test scores, contact information, busing information, attendance, demographic information and many other datapoints. The state has more than 1.5 million public schoolchildren and about 100,000 teachers.
McDowell said the breach affected the company’s entire client base, which extends to millions of students worldwide.
“PowerSchool is committed to protecting the security and integrity of our applications,” the company’s statement to WRAL News says. “We take our responsibility to protect student data privacy and act responsibly as data processors extremely seriously… PowerSchool is committed to providing affected customers, families, and educators with the resources and support they may need as we work through this together.”
North Carolina is transitioning away from PowerSchool — a decision made last year — and to Infinite Campus. A handful of school districts are piloting Infinite Campus this year but most are still on PowerSchool until the statewide transition in July.
School data breaches — and attempted breaches — are increasingly common. Data concerning minors is seen as more appealing to hackers because of the lack of public records about minors and the potential ease of stealing their identities.
Breaches in school systems have resulted in publicly published information about students, including in Minneapolis and Los Angeles.
From 2016-2022, the K12 Security Information eXchange reported 1,619 known cybersecurity incidents in K-12 schools.
Please note: This content carries a strict local market embargo. If you share the same market as the contributor of this article, you may not use it on any platform.
