At least two Massachusetts school districts have notified parents of a possible data breach reported to them by PowerSchool, a California-based provider of education software.
In letters to parents, superintendents in each district said the company informed them that an “unauthorized party” gained access to personal information of students and teachers in school districts using its PowerSchool SIS platform.
The breach includes a variety of district data, including student records, grades, attendance, and enrollment, school officials said.
It is unclear how many school districts in Massachusetts use the software. PowerSchool did not immediately respond to a request for comment from the Globe Wednesday night.
The names and home addresses of students and teachers in Needham and Nashoba Regional public schools were jeopardized, according to the superintendents’ letters.
“This news is extremely concerning, as we are entrusted with the security of private information,” the Nashoba Regional School District said in a statement. “We will be providing more information as it is made available.”
Needham school officials learned of the “potential cybersecurity incident” on Tuesday after PowerSchool, reported that information was obtained using a compromised credential, Superintendent Dan Gutekanst said in a statement.
The data might include Social Security Numbers and medical and grades information for current and former students, “depending on the specific school district.”
After informing law enforcement of the breach, PowerSchool tightened access control and conducted a password reset for all the provider’s customer support portal accounts, according to the statement. The provider does “not anticipate” that any data was shared as a result of the breach, and said any student and teacher information was deleted.
Needham has not used PowerSchool to collect social security information for years, and school officials have not received conformation that Needham schools were impacted by the breach, the statement said. PowerSchool will provide “credit monitoring” to affected adults and “identity protection services” to affected minors.
“As we receive more information ... we will relay this to families and the community and to any specific individuals impacted,” Gutekanst said in the letter. “The District is also reviewing what occurred internally and whether we need to take additional security measures on our end.”
Lila Hempel-Edgers can be reached at lila.hempeledgers@globe.com. Follow her on X @hempeledgers and on Instagram @lila_hempel_edgers.