Why did CMS OK new six-figure deal with company at center of student data breach?
Charlotte-Mecklenburg Schools board members last week approved a nearly $348,000 contract with a company that unintentionally leaked students data in 2024.
PowerSchool is a software company that the North Carolina Department of Public Instruction uses for educator evaluations and professional learning. It used to be what every public school system in the state used for student information until it was hacked in 2024. The breach exposed personal data such as addresses and social security numbers for more than 60 million students and teachers nationwide.
After the breach, North Carolina public schools, including CMS, shifted to a new student data system known as Infinite Campus, beginning this school year. NCDPI and CMS continued to use PowerSchool for employee evaluations though.
Student and parent data will continue to be housed in Infinite Campus, rather than PowerSchool, a CMS board member said last week.
“The platform we use across the district is Infinite Campus when we’re talking about grades, absences, and keeping up with those different things,” CMS Board Vice Chair Dee Rankin told WBTV.
However, when it came to why CMS continues to contract with PowerSchool after the massive data breach, which board members unanimously approved, Rankin admitted “I don’t know too many details about it.”
The Observer asked CMS why it decided to contract with both Infinite Campus and PowerSchool and how its data is being secured. A district spokesperson said decisions about student information systems are determined by NCDPI.
“Decisions and contracts about the student information system used by districts in North Carolina are made by the state,” the CMS spokesperson said. “In 2018, PowerSchool acquired multiple Human Resources platforms, including the North Carolina Educator Evaluation System. ... The North Carolina Educator Evaluation System is required to be used for certified evaluations by North Carolina.”
CMS board members voted March 24 to approve the new six-figure contract with PowerSchool as part of its consent agenda, extending from July 2026 through June 2027.
CMS’ current $325,000 contract with PowerSchool that began in July 2025 that expires this June. PowerSchool is used to “facilitate recruitment, screening, selection and hiring functionality,” according to the contract, which The Charlotte Observer obtained through a public records request.
With the new contract, CMS will have agreed to pay PowerSchool about $672,400 since the December 2024 data breach, though its human resources department has used the system since 2018.
NCDPI has two ongoing contracts with PowerSchool, an NCDPI spokesperson confirmed to The Observer Wednesday, including for its employee evaluation system.
NC Attorney General Jeff Jackson announced in Feb. 2025 that he would be investigating PowerSchool for its 2024 breach to see if the company broke any laws. That investigation is ongoing.
“Going forward, PowerSchool will continue to invest in advanced security technologies and collaborate with school districts, privacy experts and regulators to ensure our practices meet the highest standards of student data protection,” a PowerSchool spokesperson said in a statement to WBTV.
This story was originally published March 31, 2026 at 5:00 AM.
