Cybersecurity Update, May 7, 2025 – PowerSchool Data Breach and Ongoing Protection Measures

May 7, 2025

Dear Orange County Schools Families,

The following information was shared with Orange County Schools on the afternoon of May 7, 2025 by the North Carolina Department of Instruction (NCDPI):

We want to make you aware of a recent update related to the PowerSchool data breach that was originally reported in January of this year. This morning, several school and North Carolina Department of Public Instruction (NCDPI) employees across the state received messages from threat actors claiming to have access to student and teacher data from that breach. We have been informed that several Canadian school districts have received similar messages as well.

Based on the current status of our investigation, we believe that the threat actors have access to the same data tables that were originally compromised. These data tables include student and staff names, contact information, social security numbers (limited student social security numbers), birthdays, medical notes, passwords (limited) and parent/guardian information.

NCDPI has already notified appropriate law enforcement agencies, who are actively investigating this incident.

We want to assure you that your Orange County Schools and NCDPI have done everything possible to protect this information. PowerSchool, the vendor responsible for the incident, has taken full responsibility for the breach and is providing support services for those impacted.

What You Need to Know:

Please do not open any suspicious links or emails related to this incident.
Do not engage with anyone claiming to have this data.
PowerSchool is offering two years of free identity protection and credit monitoring to all affected students and educators through July 1, 2025. NCDPI is advocating for this window to be extended further to ensure everyone has time to enroll. Affected individuals can enroll in identity protection and credit monitoring at no cost to themselves here. Services include:
Two years of complimentary identity protection for all students and educators affected
Two years of complimentary credit monitoring for all adult students and educators affected
These services are available regardless of whether an individual's Social Security number was compromised.
Additional protection: Impacted users can freeze their identity for free through the North Carolina Department of Justice.