Millions in NC at risk after PowerSchool hack

RALEIGH, N.C. (WNCN) — The incident happened back in December, and as the North Carolina Attorney General’s Office enters the second stage of its investigation, it’s demanding even more answers.

“That first phase began several months ago and has been an ongoing process for most of this year,” said Attorney General Jeff Jackson.

CBS 17 Investigates spoke with Jackson about the “civil investigative demand” that he issued this week, calling for even more information about the incident.

“We want to know three things from PowerSchool. We want to know what happened, what the security flaws were that allowed this data breach to occur. We didn’t know exactly how many people in North Carolina were affected. Students, teachers, families. And we need to know what steps they’ve taken since then to communicate and to fix the security flaw that existed and allowed this hack to occur.”

A 19-year-old breached PowerSchool’s “student information system,” or “SIS,” impacting about 62 million people across the country. 

All public schools in North Carolina have used the system for the last thirteen years, but they are in the process of transitioning to a new SIS system from another provider. The transition will be completed by the end of June.

However, the North Carolina Department of Public Instruction contracts with PowerSchool for two other products used by charter and public schools.

“It’s the fact that we negotiated this contract statewide. Lots of other states did their contracting on a county-by-county or district-by-district basis,” said Jackson on Thursday.

A PowerSchool spokesperson told CBS 17 Investigates, “From the moment PowerSchool became aware of this incident, we have worked nonstop to minimize any impact on students, families, educators, and school districts.  Importantly, we have seen no evidence of fraud or further misuse of the information involved to date. In addition to thousands of customer calls, we’ve shared extensive details of the incident via a public incident webpage, including the publication of the CrowdStrike report. We will continue to work collaboratively and cooperatively with North Carolina’s Attorney General as we are with other state attorneys general.”

“PowerSchool has been in contact with the North Carolina Attorney General’s office since January 2025. The Company has provided information regarding the incident and continues to communicate transparently and cooperatively with the Attorney General’s office as we have with other state attorneys general.”

“Regarding the unauthorized activity questions, we respectfully refer you to the CrowdStrike report that confirmed that the criminal actor exfiltrated data in late December 2024.“

Attorney General Jeff Jackson tells CBS 17 that PowerSchool has been cooperative in the investigation by his office.

The company has thirty days to send Jackson’s office the information it’s demanding.  

“This is important for the public for a couple of reasons. First, the size of the impact, as I said in North Carolina, we are among the most, if not the most, impacted states in the country. Second, this has to do with kids. Anything having to do with kids and their privacy is going to be a major concern for families,” Jackson told CBS 17 Investigates. “And third, the number of teachers impacted here is potentially really significant. We have heard from a lot of teachers. I’ve personally heard from a lot of teachers about their concern about this.” 

PowerSchool is offering information on identity theft services and credit monitoring for two years for students and school staff of customers who use the SIS system.

That information can be found here.