A significant security breach at PowerSchool, a widely used education technology platform, has compelled the North Carolina Attorney General, Jeff Jackson, to launch an investigation into the incident that potentially exposed the personal data of nearly 4 million state residents. The breach, which came to light in mid-December, may have given hackers access to an array of sensitive information, including Social Security numbers, names, addresses, and possibly medical records. In the words of Attorney General Jackson, "I'm a parent who uses PowerSchool, so I know what millions of North Carolina families are concerned about with this data breach," as reported by The News & Observer. He further stated he is committed to determining if PowerSchool broke any laws during the incident and is prepared to take additional legal action if necessary.
Amid conversations around data privacy and security, PowerSchool has been at the center of North Carolina's educational fabric, maintaining records such as attendance and grades. Notified about the breach on December 28, PowerSchool immediately involved cybersecurity protocols and senior leadership, as well as third-party experts, to contain the situation, according to a statement on their website. Still investigating the company's pre-breach data protection measures, Jackson highlighted North Carolina's historical use of legal avenues to safeguard personal data in a statement obtained by ABC11. Referencing the state's involvement in the prior Equifax lawsuit, he emphasized North Carolina's resolve to hold entities accountable for data breaches.
Affecting students and teachers alike, the breach has led to more than 300,000 teacher Social Security numbers and 910 student Social Security numbers being exposed, as per reports from the North Carolina Department of Public Instruction. Wake County Public School System has alerted its students and staff to stay vigilant for any notifications that may indicate they were caught up in the breach. As shared with WRAL News, PowerSchool is extending two years of complimentary credit monitoring through Experian to those whose data was accessed.
In response to this privacy violation, the North Carolina Department of Public Instruction has expressed profound disappointment with their vendor's system's compromise, as told by Chief Information Officer Vanessa Wrenn to ABC11. The department is switching to a new platform called Infinite Campus and is currently focused on preventing any misused data from causing further harm.
