Superintendent's Newsletter 1.22.2025

Update on the PowerSchool Cybersecurity Incident

As we previously communicated, PowerSchool – a cloud-based software vendor used in Norton – recently experienced a cybersecurity incident involving unauthorized access to certain information in the PowerSchool Student Information System. We are reaching out to share more information and next steps that we recently received directly from PowerSchool:

• PowerSchool confirmed that current NPS staff and students’ personally identifiable information was accessed in the incident. The types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, and other related information from the teacher and student tables within PowerSchool.

• PowerSchool has engaged Experian, a trusted credit reporting agency, to offer two years of complimentary identity protection services for all students and educators whose information from our PowerSchool SIS was involved. This offer will also include two years of complimentary credit monitoring services for all adult students and educators whose information was involved even though we do not house social security numbers within PowerSchool. 

• Starting in the next few weeks, in collaboration with Experian, PowerSchool will provide notice to students (or their parents / guardians if the student is under 18) and educators whose information was involved, as well as a phone number to answer any questions you may have about the incident. The notice will include the identity protection and credit monitoring services offer (as applicable). 

• As soon as PowerSchool learned of the incident, they engaged cybersecurity response protocols and mobilized senior leadership and third-party cybersecurity experts to conduct a forensic investigation of the scope of the incident and to monitor for signs of information misuse. PowerSchool is not aware of any identity theft attributable to this incident.
  

We understand how frustrating this entire experience can be. We are relatively new customers to PowerSchool and put our trust in a company that was one of the first to sign the CISA’s K-12 Education Technology Secure by Design Pledge. Norton Public Schools has been working with the Massachusetts Student Privacy Alliance (MSPA) to develop a standardized data privacy agreement for all vendors that store any student information with personally identifiable information (PII). 

The Data Privacy Agreement requires all vendors to:

• Ensure industry best practices are being followed with respect to data privacy and data security.
  

• Provide the school district the right to audit the vendor for compliance.

• Not resell or use student information for any other purpose than the service it was intended.

• Provide the school district notification of a data breach, if one should occur, within a specific time frame.

• Ensure the school district retains ownership of all student data regardless of where the data resides.

• Follow the laws protecting students rights for data privacy - CIPA, COPPA, FERPA and PPRA.

Norton Public Schools are working closely with The Education Cooperative (TEC) to facilitate the execution of these data privacy agreements with all vendors.  TEC represents a number of school districts across Massachusetts and the country concerned with student data privacy.  In the meantime, we encourage you to visit   https://www.powerschool.com/security/sis-incident/ for up-to-date information on the cybersecurity incident.  Please reach out if you have any questions.

January 31st

Districtwide Early Release - Professional Development
Norton High School Term II Report Cards

February 5th

School Committee Meeting - Town Hall Crane Meeting Room

February 13th

Conferences - Norton High School

February 14th

Districtwide Early Release - Professional Development

February 17th - 21st

February Break - Schools Closed

February 26th

School Committee Meeting - Town Hall Crane Meeting Room

February 28th

Norton High School Term III Warning Notices