Hermiston SD notifies staff and families after cyber incidents at PowerSchool and Carruth Compliance

Hermiston School District officials told the board on March 10 that two third‑party vendors experienced cyber incidents in December that exposed information for some district employees and possibly students.

"In December, some of our third party providers, namely PowerSchool and Carruth Compliance, each had cyber instances," said Ms. Sol of the business office, who briefed the board during the financial report. The district said those vendors hosted data that included information tied to employees and to some student records and that the vendors notified affected individuals and offered complimentary credit monitoring services.

According to the district, Carruth Compliance is offering monitoring through IDX and PowerSchool is offering monitoring through Experian IdentityWorks. Officials urged recipients to read mailed notices and to activate monitoring. "PowerSchool has an open code that anyone in the nation can use," the district said; Carruth Compliance is using one‑time codes delivered by mail.

A board member added a public‑service reminder that every U.S. resident may obtain a free annual credit report from each of the three major bureaus via the federal government website and suggested residents use the official .gov portal rather than paid services.

District officials said they have not detected fraudulent transactions tied to the incidents and that the problems originated with the vendors, not the district database. The business office recommended employees and families take advantage of the monitoring and remain alert for suspicious activity.

The board did not take formal action on the cybersecurity briefing; the report was provided as part of the business office update.