Poquoson board reviews PowerSchool data breach response and contract terms

Poquoson City Public Schools officials reviewed the district's response to a December data breach at PowerSchool and described steps families can take after the vendor sent notification emails to impacted accounts.

In a discussion during the March 18 school board meeting, Operations Director Andrew Roberts said PowerSchool sent mass emails to families it identified as affected and the district followed up with a ParentSquare notice directing families to vendor-provided support and to the district's own reporting channel, Let's Talk. Roberts said district staff are opening tickets with PowerSchool when parents report apparent errors so those records can be corrected.

Board members pressed staff about the district's contract with PowerSchool, specifically language they read as an indemnification clause that could require a customer to defend the vendor. Tracy Spence, the district's chief financial officer, said all contracts are reviewed by the district's attorneys and noted the district is also researching alternative student-information systems used by other divisions. Spence and Roberts said the PowerSchool contract is an annual agreement and that district staff are monitoring ongoing litigation and state-level developments involving the vendor.

Roberts said the vendor's initial description of affected data to the district identified mostly directory information and limited health-related notes in some records; he told the board the district does not store Social Security numbers in the student table. "The version we got from PowerSchool for student records was just mainly directory information," Roberts said. "There could have been some data associated with health, but it would just be the brief things that would be in PowerSchool." Spence added that the district will follow any developments in state or federal actions against the vendor.

Why it matters: Poquoson uses PowerSchool for operational student data; parents, staff, and some board members expressed concerns about what fields were exposed, whether affected families received adequate notice, and what contractual protections the district has.

Details from the meeting

- Notification and support: Roberts said PowerSchool emailed families it identified as affected; the district then sent a ParentSquare message confirming the vendor outreach and directing families to PowerSchool's support lines and to the district's Let's Talk form for errors. Roberts told the board that, when families report receiving incorrect emails, district staff open tickets with PowerSchool and follow up with families.

- Data types: Roberts said the district was told the breach affected the student table and teacher table and that in Poquoson's case the vendor-reported exposures were primarily directory fields and brief health-related notes; Roberts said Poquoson does not store students' Social Security numbers in the student table.

- Contract and indemnification concerns: A board member raised language in PowerSchool's contract that appeared to require customers to indemnify the vendor. The board asked whether the district is contractually limited in what it can say publicly about the incident and whether the board can refuse terms that impose broad indemnity obligations. Spence said the district's attorneys reviewed the contract and that the division is exploring other vendors and consolidated platforms in use by peer divisions.

- Next steps: Roberts said the district can request from PowerSchool a list of the families the vendor identified as impacted; he agreed to pursue that and report back. Spence said staff will continue to communicate updates to the board and to families and will monitor any class-action litigation or other developments involving PowerSchool.

What the district did not say or confirm

- Exact count of Poquoson families affected: Roberts said PowerSchool provided a ballpark and that the vendor committed to contacting those it identified as impacted; he said an exact district-level list could be requested from PowerSchool but did not present that list at the meeting.

- Comprehensive inventory of every specific field exposed: The district reported the vendor's summary that most exposed fields were directory information and limited health notes; officials did not claim to have independently validated the full set of exposed fields.

Ending

District staff asked families who received apparent misdirected emails from PowerSchool to report the issue through Let's Talk or directly to the Operations Office so the district can open corrective tickets with the vendor. Officials said they will bring updates to the board as vendor responses, legal developments, or state actions require additional action.