The Public Schools of Northborough and Southborough

On January 7, 2025, the Public Schools of Northborough and Southborough (NSBoro) were notified by PowerSchool, the largest provider of cloud-based education software for K-12 education in the U.S., about a widespread internal data breach. This breach affected school districts nationwide, including NSBoro. Unfortunately, the breach resulted in the disclosure of NSBoro staff’s personally identifiable information (PII) to an unauthorized third party.

PowerSchool stated that a support contractor’s login account was compromised which allowed authorized access into many of their clients’ data systems.

Unauthorized access to our district’s data occurred on December 22, 2024, at 6:11 a.m. and again at 9:11 p.m..

PowerSchool became aware of the breach on December 28, 2024, when the attackers contacted them with an extortion demand in exchange for destroying the stolen data.

PowerSchool notified the District of the breach on January 7, 2025, at approximately 2:00 p.m., via email.

PowerSchool confirmed that they paid the attackers an undisclosed amount in exchange for a video showing the electronic destruction of the stolen data.

Yes, the district uses several PowerSchool products, including Records, TalentEd, and SchoolSpring. However, PowerSchool has stated that only the PowerSchool SIS (Student Information System) was affected by this data breach.

PowerSchool has created a site of their own for Frequently Asked Questions.

Please refer to the table below for detailed information on the data fields included in the breach. Two tables from within PowerSchool SIS were exported: “Students_export.csv” and “Teachers_export.csv”. From reviewing available log data, we were able to reconstruct the fields exported by the unauthorized user. We have also included summary statistics regarding the percentage of those fields containing actual data.

No medical records were compromised, as they are stored in a separate system. However, some medical alerts and physician information related to students were disclosed.

No custody records were compromised, as they are stored in a separate system. However, some medical alerts and physician information related to students were disclosed.

General custody information was not compromised. However, guardian alerts were disclosed. This contains a brief note if there was a need for a child to have a custody alert in our system due to a court order. If you have concerns, please contact us at help@nsboro.k12.ma.us.

• Current students and staff: Social Security numbers are not actively stored in PowerSchool SIS, so no Social Security numbers were disclosed.  
• Former students: We are investigating one incident involving a former student’s Social Security number. That individual is being contacted directly.

PowerSchool has assured the district that no passwords were compromised and no data was tampered with. Based on this information, we are continuing to use PowerSchool SIS. There are no restrictions on the use of the software by either students or staff at this time.

PowerSchool has engaged with CrowdStrike, a leading cybersecurity organization, to conduct a forensic analysis of event logs during the unauthorized access period. They will provide updates if new information becomes available. However, PowerSchool does not feel any backdoor access was created.

We are currently reviewing all of our digital systems to ensure they are as secure as possible, including account audits, configuring multi-factor authentication, and implementing automated account management between key data systems, where possible.

We are currently awaiting additional information regarding this possibility.

• This page contains a list of digital resources that have been vetted for use and student data privacy protections.   Many websites, including free online educational tools, gather personal data and/or are not intended for use by children under 13 without written parental consent.  Our school District partners with The Education Collaborative to help manage issues related to student data privacy. This partnership helps us, and other school systems in Massachusetts obtain Student Data Privacy Agreements with educational platforms. These agreements are legally enforceable agreements between vendors and the school districts that give schools and districts ownership & control of student data as well as define how a vendor may and may not use a child’s personal data.   Some platforms and vendors refuse to sign the agreement. Student safety is a priority of our District, and until the requested vendor allows NSBoro Schools the ownership of the personal information collected, children may continue to be blocked from accessing the website. 

Student Data Table