PowerSchool Data Breach Information

The following message was sent to families on Friday, January 17, 2025:

Dear Parent(s) and Guardians(s),

This afternoon, the District learned more information from PowerSchool regarding what monitoring services it will provide families, due to the data breach. In the next week or two, families can expect the following:

• Identity Protection and Credit Monitoring Services: PowerSchool has engaged Experian, a trusted credit reporting agency, to offer two years of complimentary identity protection services for all students and educators whose information from our PowerSchool SIS was breached. This offer will include two years of complimentary credit monitoring services for all adult students and educators whose information was involved.

• Notification to Individuals Involved: Starting in the next few weeks, in collaboration with Experian, PowerSchool will provide notice to students (or their parent(s)/guardian(s) if the student is under 18) and educators whose information was breached, as well as a phone number to answer any questions you may have about the incident. The notice will include the identity protection and credit monitoring services offered.

In the meantime, I encourage families to visit the NSboro PowerSchool Data Breach site and PowerSchool’s FAQ site for up-to-date information on the incident. If you have any additional questions, please reach out by emailing help@nsboro.k12.ma.us.

Respectfully,

Gregory L. Martineau
Superintendent of Schools

Jon Parent
Director of Information Technology

Cathy Carmignani
Director of Instructional Technology

The following message was sent to families on Wednesday, January 8, 2025 via ParentSquare.

Dear Parent(s) and Guardian(s),

On January 7, 2025, The Public Schools of Northborough and Southborough’s (NSboro) student information system vendor, PowerSchool (the largest provider of cloud-based education software for K-12 education in the U.S), notified us that a widespread internal PowerSchool data breach affecting districts nationwide had occurred. Unfortunately, this resulted in NSboro’s student and staff personally identifiable information being accessed by an unauthorized third party. 

Protecting the privacy and security of student, family, and staff data is a top priority for our District. As soon as we were made aware of the situation, we initiated our own internal investigation to confirm PowerSchool’s findings. PowerSchool told its clients: “The incident is contained, and we do not anticipate the data being shared or made public.” We will continue working with PowerSchool to understand what data was exported and how they will provide support to those affected.

We are committed to ensuring transparency and providing information about how this is being addressed. Once we have more information from PowerSchool, we will send out additional communications. In the meantime, please reach out with any immediate concerns to help@nsboro.k12.ma.us. 

Respectfully,

Gregory L. Martineau
Superintendent of Schools

Jonathan Parent
Director of Information Technology 

On January 7, 2025, the Public Schools of Northborough and Southborough (NSBoro) were notified by PowerSchool, the largest provider of cloud-based education software for K-12 education in the U.S., about a widespread internal data breach. This breach affected school districts nationwide, including NSBoro. Unfortunately, the breach resulted in the disclosure of NSBoro staff’s personally identifiable information (PII) to an unauthorized third party.

PowerSchool stated that a support contractor’s login account was compromised which allowed authorized access into many of their clients’ data systems.

Unauthorized access to our district’s data occurred on December 22, 2024, at 6:11 a.m. and again at 9:11 p.m..

PowerSchool became aware of the breach on December 28, 2024, when the attackers contacted them with an extortion demand in exchange for destroying the stolen data.

PowerSchool notified the District of the breach on January 7, 2025, at approximately 2:00 p.m., via email.

PowerSchool confirmed that they paid the attackers an undisclosed amount in exchange for a video showing the electronic destruction of the stolen data.

Yes, the district uses several PowerSchool products, including Records, TalentEd, and SchoolSpring. However, PowerSchool has stated that only the PowerSchool SIS (Student Information System) was affected by this data breach.

PowerSchool has created a site of their own for Frequently Asked Questions.

Please refer to the table below for detailed information on the data fields included in the breach. Two tables from within PowerSchool SIS were exported: “Students_export.csv” and “Teachers_export.csv”. From reviewing available log data, we were able to reconstruct the fields exported by the unauthorized user. We have also included summary statistics regarding the percentage of those fields containing actual data.

No medical records were compromised, as they are stored in a separate system. However, some medical alerts and physician information related to students were disclosed.

No custody records were compromised, as they are stored in a separate system. However, some medical alerts and physician information related to students were disclosed.

General custody information was not compromised. However, guardian alerts were disclosed. This contains a brief note if there was a need for a child to have a custody alert in our system due to a court order. If you have concerns, please contact us at help@nsboro.k12.ma.us.

Current students and staff: Social Security numbers are not actively stored in PowerSchool SIS, so no Social Security numbers were disclosed.  

Former students: We are investigating one incident involving a former student’s Social Security number. That individual is being contacted directly.

PowerSchool has assured the district that no passwords were compromised and no data was tampered with. Based on this information, we are continuing to use PowerSchool SIS. There are no restrictions on the use of the software by either students or staff at this time.

PowerSchool has engaged with CrowdStrike, a leading cybersecurity organization, to conduct a forensic analysis of event logs during the unauthorized access period. They will provide updates if new information becomes available. However, PowerSchool does not feel any backdoor access was created.

We are currently reviewing all of our digital systems to ensure they are as secure as possible, including account audits, configuring multi-factor authentication, and implementing automated account management between key data systems, where possible.

We are currently awaiting additional information regarding this possibility.

This page contains a list of digital resources that have been vetted for use and student data privacy protections.   Many websites, including free online educational tools, gather personal data and/or are not intended for use by children under 13 without written parental consent.  Our school District partners with The Education Collaborative to help manage issues related to student data privacy. This partnership helps us, and other school systems in Massachusetts obtain Student Data Privacy Agreements with educational platforms. These agreements are legally enforceable agreements between vendors and the school districts that give schools and districts ownership & control of student data as well as define how a vendor may and may not use a child’s personal data.   Some platforms and vendors refuse to sign the agreement. Student safety is a priority of our District, and until the requested vendor allows NSBoro Schools the ownership of the personal information collected, children may continue to be blocked from accessing the website.