Data Breach Summary
PowerSchool, a leading provider of cloud-based educational technology, confirmed a significant cybersecurity breach affecting the personal data of students and educators across K-12 school districts in the United States. The breach began on December 19, 2024, but wasn’t detected until December 28, 2024.
Hackers gained unauthorized access to PowerSchool’s PowerSource portal by using stolen login credentials. They then exploited a tool called the “export data manager,” which is usually used by PowerSchool engineers for system maintenance, to steal sensitive information from the “Students” and “Teachers” tables. This data was extracted into a CSV file and stolen.
PowerSchool serves over 55 million students and 17,000 educational customers in more than 90 countries, so the scope of the breach is considerable. While the compromised data mostly includes contact details, for some districts, the breach also involves sensitive information like Social Security numbers, personally identifiable information (PII), medical records, and academic records.
On January 7, 2025, PowerSchool proactively communicated the breach to affected PowerSchool SIS customers and continues to support them through next steps. Importantly, districts and schools not utilizing PowerSchool SIS were not affected by the breach. PowerSchool has confirmed that there is no evidence of continued unauthorized activity, malware, or impact to other PowerSchool products.
As part of the ongoing investigation, PowerSchool is working to set up a system in coordination with affected customers to provide supportive resources, including credit monitoring or identity protection services, for individuals whose data may have been involved. As more definitive information becomes available regarding the timeline, PowerSchool will share updates accordingly.
To assist with the investigation, PowerSchool enlisted CrowdStrike, a leading cybersecurity firm. One of the services provided includes dark web monitoring to help track potential misuse of the stolen data.
Individuals associated with PowerSchool are advised to remain vigilant for any signs of suspicious activity involving their personal data. To protect against potential risks, it’s recommended to regularly monitor financial statements, update passwords, and exercise caution with unsolicited communications, such as phishing attempts. For additional guidance on safeguarding your information following a data breach, we encourage you to review this resource on responding to data breaches and the proactive steps you can take to protect yourself.
The breach has impacted several school districts, including Lexington School District Four, Camas County School District, Perkins School for the Blind, and Lancaster County School District. PowerSchool has reached out to these districts and others affected by the incident.
After reviewing the affected data, it was confirmed that a document containing personal information, including name, social security number, PII, medical details, even academic record, and other sensitive details, had been accessed.
If you received a data breach notification from PowerSchool, it likely means your information was affected. Class Action U, in partnership with KO Lawyers, is supporting individuals impacted by the PowerSchool data breach. If your information was exposed in this breach, you may be eligible to join a class action lawsuit to seek compensation for:
A successful case could also compel PowerSchool, to enhance its security practices to prevent similar incidents in the future. Contact Class Action U today to explore your legal options and protect your rights.
©2024 ClassActionU
