Superintendent Dr. Scott Sawyer told the Shrewsbury School Committee on Jan. 8 that the district was affected by a cybersecurity incident that originated at PowerSchool, the company Shrewsbury Public Schools uses for student and staff records.

Dr. Sawyer said the district confirmed the incident involved demographic data: student and staff names, addresses, phone numbers, email addresses, student and staff ID numbers and student birth dates. "This wasn't through the Shrewsbury system," Dr. Sawyer said, adding that the breach came through PowerSchool and that multiple districts nationwide were affected.

PowerSchool leadership told districts in a webinar that the actor had been paid and the downloaded data was destroyed, Dr. Sawyer said. "They have assured us that they don't anticipate any of that data continuing to exist outside of our system," he said. PowerSchool is working with a cybersecurity firm and federal agencies, the district was told.

Dr. Sawyer listed what was not affected: passwords, payment/credit-card information, educational records, staff personnel records, photos and student health records (though he noted some health-related flags such as food-allergy alerts sit in the demographic field and would have been captured if present).

The superintendent said PowerSchool plans to provide credit monitoring to affected adults and identity-protection services for affected minors "in accordance with regulatory and contractual obligations." The district’s information-technology director, Mr. Phillips, and human-resources executive director, Ms. Malone, were mentioned as points of contact for questions.

Dr. Sawyer urged staff and families to monitor accounts, report suspicious activity to school-based tech teams and to be cautious of phishing attempts. He thanked the town and regional partners for support on cybersecurity work and said the incident appeared to have originated with PowerSchool rather than the local Shrewsbury environment.

The district will share further details with families and staff as they become available, Dr. Sawyer said.