Dear Needham Public Schools Families: I am writing to let you know that on January 7th the district was informed by PowerSchool <https://www.powerschool.com/>, our student information system application, that on December 28, 2024, PowerSchool became aware of a potential cybersecurity incident involving unauthorized access to certain information through one of its community-focused customer support portals, PowerSource. PowerSchool has indicated an unauthorized party gained access to certain PowerSchool Student Information System (“SIS”) customer data using a compromised credential, and that District data was accessed. Specifically, PowerSchool reported that it: “Believe[s] the export data manager tool was used to extract only student and teacher tables. These tables primarily include contact information with data elements such as name and address information. For a subset of the customers, these tables may also include Social Security Number (SSN), other Personally Identifiable Information (PII), and some medical and grades information for current and former students depending on the specific school district.” PowerSchool has reported to the District that it “engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. We have also informed law enforcement.” PowerSchool further reported that: “Importantly, the incident is contained, and we have no evidence of malware or continued unauthorized activity in the PowerSchool environment.” It further stated: “We have also deactivated the compromised credential and restricted all access to the affected portal. Lastly, we have conducted a full password reset and further tightened password and access control for all PowerSource customer support portal accounts.” Finally, PowerSchool has indicated that: “We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination. . . .We have a video confirming deletion and are actively searching the dark web to confirm.” The Needham Public Schools has not collected social security information from staff or families through PowerSchool for many years, but PowerSchool has indicated that it will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations. The Needham Public Schools does not have direct confirmation that it was impacted in any way by this breach. We are following up with PowerSchool to find out more information on how the District may have been affected and for more details on the incident. As we receive more information, and as appropriate, we will relay this to families and the community and to any specific individuals impacted. The District is also reviewing what occurred internally and whether we need to take additional security measures on our end. I'll be sure to keep you updated with any relevant and new information. Thanks, Dan Gutekanst Superintendent of Schools Needham Public Schools 1330 Highland Avenue, Needham, MA 02492 *He/His/Him* 781-455-0400 x11203 dan_gutekanst@needham.k12.ma.us ATTENTION: If you speak a language other than English, language assistance services are available to you free of charge. Contact your child’s school for assistance. Chinese (Simplified): 请注意：如果您的母语不是英语，我们将免费提供您语言辅助服务。如需协助，请与您孩子 的学校联系。 Spanish: ATENCION: Si usted habla un idioma que no sea el inglés, hay servicios de asistencia lingüística disponibles gratis. Contacte la escuela de su hijo para asistencia. Russian: ВНИМАНИЕ: Если вы не говорите на английском языке, для вас доступны бесплатные языковые сервисы на вашем языке. Обратитесь за помощью в школу, в которой учится ваш ребенок.