Ed-Tech · Ed-tech (K-12 student information system) · Regulatory action + Private litigation + Data breach
PowerSchool
Headline
The December 2024 PowerSchool breach is the largest student-data breach on record in this tracker: attackers used credentials stolen from a subcontractor to get into PowerSchool's customer-support portal and pulled…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The December 2024 PowerSchool breach is the largest student-data breach on record in this tracker: attackers used credentials stolen from a subcontractor to get into PowerSchool's customer-support portal and pulled school databases covering a reported 62.4 million students and 9.5 million teachers across 6,505 school districts. Exposed data reportedly included Social Security numbers, medical and special-education records, parent contact details and even bus-stop locations. PowerSchool paid a ransom to stop the leak, yet the attackers still went on to extort individual school districts. Paying a criminal to delete data protects no one, and the families had no say in it: schools, not parents, chose PowerSchool.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. www.jpml.uscourts.gov/sites/jpml/files/MDL-3149-Transfer_Order-3-25.pdf — Unverified - heuristic first draft.
Terms
Arbitration
Not verified this pass. Terms not retrievable (bot-protection wall); end users are students/parents using school-procured accounts.
Data sharing
CONFIRMED BREACH (Dec. 19-28, 2024): names, addresses, phone numbers, passwords, parent information, SSNs and medical data for a reported 62.4M students and 9.5M teachers; Texas AG adds special-education records and bus-stop locations, and alleges the data was transferred unencrypted to a foreign server. A ransom was paid (amount undisclosed), and districts were still individually extorted afterward. Privacy policy not retrievable this pass (bot-protection wall), so sale/sharing disclosures not verified.
Fees and billing
None identified. Product is paid for by school districts, not families.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. Private company: the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| News · 2025-10 (a www.bleepingcomputer.com/news/security/powerschool-hacker-gets-sentenced-to-four-years-in-prison/ | whole row | Unassigned | confirmed | “While PowerSchool paid a ransom to prevent the data leak, it's still unclear how much was paid.” Quote basis: not recorded. |
| State AG press release · 2025-09-03 texasattorneygeneral.gov/news/releases/attorney-general-paxton-sues-big-tech-company-catastrophic-data-breach-compromised-personal | whole row | Unassigned | confirmed | “failed to implement even the most basic security features, including multi-factor authentication” Quote basis: not recorded. |
| Court order (JPML) · 2025-04-07 www.jpml.uscourts.gov/sites/jpml/files/MDL-3149-Transfer_Order-3-25.pdf | whole row | Unassigned | confirmed | “This litigation consists of 32 actions pending in three districts” Quote basis: not recorded. |
| Plaintiff law-firm summary · 2026-04-01 www.hausfeld.com/news/court-denies-motions-to-dismiss-in-powerschool-data-breach-litigation | whole row | Unassigned | confirmed | “The Court recently denied defendants' motions to dismiss” Quote basis: not recorded. |
| Secondary blog · 2026 (unda captaincompliance.com/education/the-powerschool-settlement-the-largest-student-data-breach-in-u-s-history-and-what-edtechs-privacy-crisis-means-for-every-family-in-america/ | whole row | Unassigned | confirmed | “The $17.25 million settlement fund will be distributed on a pro rata basis among eligible class members.” Quote basis: not recorded. |
| Encyclopedia · 2026-10-16 en.wikipedia.org/wiki/PowerSchool | whole row | Unassigned | confirmed | “On October 1, 2024, Bain announced it had completed the purchase and conversion.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy powerschool.com/privacy/ (fetch blocked this pass) | Not fetched yet | NOT CONFIRMED |
| Terms of service No URL recorded | Not fetched yet | NOT CONFIRMED |
| Website powerschool.com | Not fetched yet | — |
| Primary source https://www.jpml.uscourts.gov/sites/jpml/files/MDL-3149-Transfer_Order-3-25.pdf Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
| Action | Amount | Link |
|---|---|---|
| State of Texas v. PowerSchool Texas Attorney General, 2025 Petition filed Sept. 3, 2025 (Collin County, Tex.). | — | proposed |
Links are proposed matches, not yet reviewed.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |