PowerSchool Data Breach - Next Steps

Identity Protection and Credit Monitoring Services: PowerSchool will be offering two years of complimentary identity protection services for all students and educators whose information was exfiltrated from your PowerSchool SIS, which will also include two years of complimentary credit monitoring services for all adult students and educators whose information was involved, regardless of whether an individual’s Social Security number was exfiltrated.

Experian, a trusted credit reporting agency, will be helping us to provide these services. Details on how to enroll will be included as part of individual notifications. As the offer is specific to this incident, the details contained in the forthcoming enrollment notification will be required to enroll, and cannot be obtained directly from Experian.

Credit monitoring agencies do not offer credit monitoring services for individuals under the age of 18. If a parent / guardian enrolls an individual under the age of 18 in the offered identity protection services, the individual, upon turning 18, will have the opportunity to enroll in credit monitoring services for the duration of the two-year coverage period.

Notifications: You may have notification obligations to key stakeholders in our shared community. To reduce the burden of these notifications on you and your institution, PowerSchool will be handling notification to individuals and state attorney general offices on your behalf.

• Community: In coordination with Experian, PowerSchool will provide notice on your behalf to students (or their parents / guardians for students under 18) and educators whose information was exfiltrated from your PowerSchool SIS.
  • PowerSchool will publish the notice on its website, circulate the notice to local media, and send the notice to email addresses, where available, of involved individuals.
  • The notice received by each individual will include a description of the categories of personal information that were exfiltrated and the identity protection and credit monitoring services offered (as applicable).
  • We will also provide you a link to the notification if you would like to share with your community. o Experian will also provide a call center to answer questions from the community.
• Regulatory: PowerSchool will provide notification on your behalf to relevant state attorney general offices. You may also have notification requirements with your state’s Department of Education. Since many customers have already notified and are in close contact with their state’s Department of Education, PowerSchool will defer to you on these notifications.
• For involved students and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Security Number (SSN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base.
• Timing: PowerSchool intends to begin the notification process for relevant students, parents / guardians of students, educators, and state attorney general offices (as applicable) in the next few weeks. If your institution does not want PowerSchool to notify individuals or state attorney general offices on your behalf, please contact PowerSchool Customer Support or your designated CSM, or log a customer support ticket, by no later than January 24, 2025.
• If you are an on-premise PowerSchool SIS customer who would like PowerSchool to complete these notification processes on your behalf, please contact PowerSchool Customer Support or your designated CSM by no later than January 24, 2025. Otherwise, we will provide you a link and a relevant communication in the coming weeks that you can use to notify involved individuals.

We have also posted additional FAQs in the PowerSchool Community Portal.