Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Burke County Schools: PowerSchool incident affected staff Social Security numbers; credit monitoring offered
Summary
Technology staff told the board PowerSchool confirmed district data was included in a late-December breach; PowerSchool is coordinating credit-monitoring through Experian for impacted persons.
Doctor Edwards told the board that PowerSchool reported a credential compromise affecting its systems in late December and that North Carolina Department of Public Instruction (NCDPI) confirmed Burke County data was involved. "On January 10th, NCDPI confirmed that Burke County student and teacher data was included," Edwards said.
Edwards said the initial NCDPI report listed three student Social Security numbers and other directory data; she reviewed the district’s records and found that student Social Security numbers had been purged from PowerSchool years earlier and that the student entries flagged by DPI were placeholders. Edwards said the breach did include staff Social Security numbers and that an initial count showed about 3,325 staff Social Security numbers were compromised.
Edwards said she participated in calls with PowerSchool and NCDPI and that PowerSchool has engaged Experian to provide credit monitoring and identity protection services to any student or staff member whose data was in PowerSchool going back to 2013. "PowerSchool has partnered with Experian to provide credit monitoring, and identity protection for any student or staff, regardless of whether they were impacted or not," Edwards said, adding that PowerSchool and Experian will provide notification and that DPI will host information on its site.
Edwards told the board the district took steps to notify families and that initial courtesy notices had already been posted to the district website and emailed to contacts available in the student information system. She said PowerSchool and NCDPI told district staff they were monitoring the dark web for any dissemination of the data and that PowerSchool maintains the position the data was contained and deleted.
Board members asked how affected people would receive Experian notifications; Edwards said PowerSchool/Experian would communicate directly to impacted individuals and the district would link or repost that communications on the district website when it arrives.
Ending: Edwards said the district already enforces two-factor sign-in for email accounts and administrative access to NC EdCloud, uses CrowdStrike Falcon for malware detection and applies device restrictions on student Chromebooks. She said the district will post redirected guidance once Experian/PowerSchool notifications are available.
