PowerSchool Data Breach

FOR IMMEDIATE RELEASE

January 9, 2025


Lancaster County School District has been notified of a data breach to PowerSchool, our Student Information System, which occurred on December 19, 2024.  The breach impacted PowerSchool users worldwide.  Lancaster County School District was breached on December 22, 2024.  We were notified of the breach on the evening of January 7, 2025.

The South Carolina Department of Education released the following Press Release on January 8, 2025.

SCDE responds to PowerSchool Data Breach

Jan 8, 2025

Late Tuesday, the South Carolina Department of Education (SCDE) was informed by PowerSchool of a cybersecurity breach involving its PowerSource portal. This was an international incident over which the state and local districts had no control.

This breach resulted in unauthorized access to certain customer data from PowerSchool’s Student Information Systems (SIS), including data from multiple states and school districts across the country. 

During a meeting with PowerSchool’s senior leadership, they confirmed that personally identifiable information (PII) was compromised. The SCDE is currently working to understand the full scope of the breach.

PowerSchool has stated that this breach has been contained and has informed the SCDE that it has taken steps to secure its systems, engage cybersecurity experts, and is also coordinating with law enforcement to address the breach. 

The SCDE is actively communicating with PowerSchool, legal counsel, and local districts to assess the full impact on South Carolina schools, students, and educators and to determine next steps. The SCDE is also in direct communication with the State Law Enforcement Division (SLED), the Attorney General’s office and has notified the Governor and legislative leaders.

Commenting on the seriousness of this incident, State Superintendent of Education Ellen Weaver said, “The protection of our South Carolina students’ and educators’ personal data is non-negotiable. We fully recognize the anxiety this raises for them and their families.” 

She continued, “While PowerSchool has taken accountability for this breach, our Department will take uncompromising action to ensure we uncover the complete extent of this incident.  We will insist that PowerSchool not only notify affected individuals but also provide them with credit and identity monitoring services."

The SCDE will continue to engage and support districts and schools throughout this process as more information becomes available.

Lancaster County School District will continue to keep you informed as more information becomes available.  For more information, visit the South Carolina Department of Education’s landing page: https://ed.sc.gov/newsroom/news-releases/scde-responds-to-powerschool-data-breach/

PowerSchool provided the following communication on Monday, January 27, 2025:

Dear Valued Customers,

I am writing today to inform you that our investigation and data review into the scope of the cybersecurity incident has continued in earnest. As part of our commitment to keeping you informed, we are reaching out with an update on the latest steps we have taken in response to this incident and what you can expect over the coming days.

Importantly, this message requires no action on your part and serves simply as an update.

This afternoon, PowerSchool began the process of filing state attorneys general notifications across applicable U.S. jurisdictions on behalf of customers who did not opt-out of our offer to do so. PowerSchool has also started the process of notifying Canadian regulators.

For our U.S. customers, you may also have notification requirements with your state’s Department of Education. Since many customers have already notified and are in close contact with their state’s Department of Education, PowerSchool will defer to you on making these notifications.

In the coming days, PowerSchool will begin providing formal legal notice of the cybersecurity incident to current and former students (or their parents / guardians as applicable) and educators whose information was determined to be involved.

A direct email notification will be distributed by Experian on behalf of PowerSchool in the coming weeks to applicable current and former students (or their parents / guardians as applicable) and educators for whom we have sufficient contact information. PowerSchool will also launch a website and distribute a media release to ensure we reach as many involved individuals as possible and provide them with resources to protect their information. Importantly, these notices will include instructions for involved individuals on how to enroll in the credit monitoring and identity protection services that are being offered by PowerSchool.

PowerSchool will also be providing you with communications materials to help navigate conversations with families and educators as part of our effort to support you with the expected inquiries from your community members.

Thank you for your ongoing patience and partnership.

Hardeep Gulati

Chief Executive Officer, PowerSchool