Charlotte-Mecklenburg Schools Reports Data Breach Affecting Canvas Portal Charlotte-Mecklenburg Schools (CMS) in North Carolina has disclosed a data breach involving Canvas, a third-party online learning platform used by teachers to post assignments. The district confirmed that the incident may have exposed some personal information but emphasized that CMS’s internal systems remained unaffected. The breach was identified and contained by Instructure, the company behind Canvas, which stated that the portal remains fully operational. While details on the scope of the exposed data have not been fully disclosed, CMS is investigating the incident to determine the extent of the impact on students and staff. The breach highlights ongoing risks associated with third-party educational platforms, particularly as schools increasingly rely on digital tools for remote and hybrid learning. Further updates are expected as the investigation progresses.

Charlotte-Mecklenburg Schools Reinstates PowerSchool Contract Despite 2024 Data Breach Charlotte-Mecklenburg Schools (CMS) has approved a new one-year contract with PowerSchool, the education software provider behind a major 2024 data breach that exposed personal information of North Carolina students and teachers. The $347,000 agreement, finalized during a June 2025 Board of Education meeting, restricts PowerSchool’s use to district employees covering educator evaluations, professional development, and job application software while excluding student and parent data. The breach, which prompted the North Carolina Department of Public Instruction to terminate its statewide PowerSchool contract in late 2024, led CMS to transition student records to Infinite Campus. Board Vice Chair Gregory “Dee” Rankin confirmed that Infinite Campus remains the district’s primary platform for grades, attendance, and student-related data, emphasizing no change in that system. PowerSchool stated that its 2025 incident report guided security improvements, including investments in advanced protections and collaborations with regulators. The company’s limited role in CMS focused on HR functions like job applications and internal evaluations reflects a narrower scope post-breach. CMS clarified that PowerSchool’s tools remain in use by the state for educator assessments but are no longer tied to student data in the district.

A cyberattack on PowerSchool, a leading education software platform, resulted in the exfiltration of personal data of 62 million students and 9 million teachers. Despite paying the ransom, the data was not wiped, and hackers are now targeting individual schools using the stolen information. The breach affected over 6,500 school districts in the US and Canada. The exfiltrated data includes Social Security Numbers, names, addresses, and medical information. PowerSchool has offered free credit monitoring and identity theft protection to mitigate risks.