North Carolina Attorney General Jeff Jackson has sent a demand letter to PowerSchool for answers regarding the December 2024 data breach that likely affected millions of the state's students and teachers.
PowerSchool has since 2013 kept the data of all North Carolina schoolchildren and teachers. Their personal data was hacked into in December.
Other WRAL Top Stories
Jackson announced in January that he would investigate the breach.
On Tuesday, Jackson said he's sending a Civil Investigative Demand to the company because he doesn't have answers to basic questions about what happened.
Demand letters are often filed before lawsuits.
Jackson said the demand will legally compel the company to answer those questions, such as exactly how many people were affected and what security flaws may have contributed to the breach.
PowerSchool didn't immediately responded to a request for comment Wednesday.
WRAL News reported in May that the hacker accessed a compromised account that didn't have multifactor authentication. WRAL also reported that the company had told schools that it had paid a ransom to the hacker in exchange for the hacker promising to the delete the data, then company officials watched a video of the hacker purportedly deleting the data.
Later in May, school employees in North Carolina and beyond were targeted by an unknown actor claiming to have the data -- which North Carolina Department of Public Instruction officials said appeared to be authentic -- and asking for cryptocurrency in exchange for deleting it. The company then publicly confirmed paying the ransom and apologized for the developments. "It pains us that our customers are being threatened and re-victimized by bad actors," the company's May 7 statement says.
Later in May, a Massachusetts college student pleaded guilty to two felony counts related to the PowerSchool breach and two felony counts related to an earlier, and unsuccessful, attempt to extort a different company from which he had accessed data.
Current and former teachers and students have until July 31 to sign up for two years of free credit protection now being offered by PowerSchool. WRAL in May reported why children are especially vulnerable to data breaches and how people can sign up for credit protection.