Needham and Nashoba are among the districts where a PowerSchool violation may have occurred

Needham and Nashoba are among the districts where a PowerSchool violation may have occurred

At least two school districts in Massachusetts have notified parents of a possible data breach reported to them by PowerSchool, a California-based education software provider.

In letters to parents, supervisors in each district said the company had informed them that an “unauthorized party” had gained access to personal data of students and teachers in school districts using its PowerSchool SIS platform.

The breach affects a variety of district data, including student records, grades, attendance and enrollment, school officials said.

It’s unclear how many school districts in Massachusetts use the software. PowerSchool did not immediately respond to a request for comment from the Globe on Wednesday evening.

According to letters from school leaders, the names and home addresses of students and teachers in Needham and Nashoba area public schools were at risk.

“This news is extremely concerning as we are entrusted with the security of private information,” the Nashoba Regional School District said in a statement. “We will provide further information as it becomes available.”

Needham school officials learned of the “potential cybersecurity incident” on Tuesday after PowerSchool reported that information was obtained using a compromised ID card, Superintendent Dan Gutekanst said in a statement.

The data may include Social Security numbers and medical and grade information for current and former students, “depending on the specific school district.”

After notifying law enforcement of the breach, PowerSchool tightened access controls and performed a password reset on all of the provider’s customer support portal accounts, the statement said. The provider “does not believe” any data was shared as a result of the breach and said all student and teacher information was deleted.

Needham has not used PowerSchool to collect Social Security information for years, and school officials have not received confirmation that Needham schools were affected by the breach, the statement said. PowerSchool will provide “credit monitoring” to affected adults and “identity protection services” to affected minors.

“As we receive more information, we will share it with families and the community, as well as all affected individuals,” Gutekanst said in the letter. “The district is also reviewing what happened internally and whether we need to take additional security measures on our part.”


Lila Hempel-Edgers can be reached at [email protected]. Follow her on X @hempeledgers and on Instagram @lila_hempel_edgers.

Leave a Reply

Your email address will not be published. Required fields are marked *