PowerSchool Data Breach 2025: What Schools Must Know

Updated October 2026 with the court rulings and developments since this article was first published.

The PowerSchool data breach is one of the largest cybersecurity incidents in K-12 history. In December 2024, an attacker used a single stolen password to reach the systems of PowerSchool, one of the largest student information system (SIS) providers in North America, and took records belonging to students and teachers in thousands of school districts. The hacker has since been sentenced to prison, state attorneys general have taken action, and a national lawsuit against PowerSchool and its owner is moving forward. This article explains what happened, where the case stands in 2026 and what districts should do.

What happened in the PowerSchool data breach

The intrusion

PowerSchool says it became aware of the incident on December 28, 2024. The attacker accessed PowerSource, PowerSchool’s customer support portal, using a single compromised credential, and from there extracted data from customers’ SIS databases. PowerSource did not support multi-factor authentication at the time, TechCrunch reported, and an investigation found the same credential had been used in an earlier intrusion in August and September 2024.

How many people were affected

PowerSchool has said it cannot confirm precise numbers. The hacker’s extortion demand claimed data from 6,505 school districts, and sources put the total at about 62.4 million students and 9.5 million teachers, BleepingComputer reported. PowerSchool told The Record that about 6,500 of its more than 18,000 customers were affected.

What data was taken

According to PowerSchool, the data included names, contact information, dates of birth and limited medical alert information, and for some people Social Security numbers. PowerSchool said more than three-quarters of affected students did not have Social Security numbers taken, and it found no evidence that credit card or banking information was involved. Where districts had added custom fields, the stolen data also included special education status, custody alerts and disciplinary notes. Records went back years: an attorney for Westerville City Schools in Ohio said the district had reason to believe data from 1996 was included.

Extortion and the ransom

PowerSchool says it decided to pay a ransom. Even so, in May 2025 the attacker contacted multiple school districts directly in an attempt to extort them, using samples that matched the data stolen in December.

The hacker’s sentence

On October 14, 2025, Matthew D. Lane, 20, of Sterling, Massachusetts, a former Assumption University student, was sentenced to four years in federal prison and ordered to pay $14.08 million in restitution and a $25,000 fine. He pleaded guilty to cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers and aggravated identity theft. Prosecutors said he threatened to leak data on more than 60 million students and 10 million teachers unless he was paid about $2.85 million in Bitcoin.

Where the PowerSchool lawsuits stand in 2026

• The national case. Suits from families, students and school districts were consolidated in federal court in the Southern District of California as In re PowerSchool Holdings, before Judge Roger T. Benitez. The defendants are PowerSchool, its owner Bain Capital, and Movate, a contractor. On March 18, 2026, the court denied the motions to dismiss filed by PowerSchool and Bain, allowing claims including negligence, unjust enrichment and California unfair-competition claims to proceed. The parties are now in discovery, and no settlement has been reported.
• School districts. Memphis-Shelby County Schools, Tennessee’s largest district, sued in May 2025, and districts including West Ada in Idaho and Chelsea in Michigan voted in November 2025 to join the federal case. The court allowed the districts’ breach-of-contract claims to proceed.
• Texas. Attorney General Ken Paxton sued PowerSchool in September 2025 under the state’s Deceptive Trade Practices Act and identity theft law, saying the breach affected more than 880,000 Texas children and teachers.
• North Carolina. Attorney General Jeff Jackson issued a civil investigative demand to PowerSchool in June 2025; his office says the breach affected nearly 4 million teachers, students and parents in the state.

A separate case is sometimes confused with the breach. In 2026, PowerSchool agreed to a $17.3 million settlement over tracking in its Naviance college-planning software, Bloomberg Law reported. That case concerns how student data was tracked, not the December 2024 breach.

What PowerSchool did

PowerSchool says it engaged CrowdStrike to investigate, reported the incident to law enforcement in the United States and Canada, notified districts beginning January 7, 2025, and notified affected individuals beginning January 29. It offered two years of identity protection and credit monitoring; enrollment closed on July 31, 2025. Districts and state officials have questioned how long the compromised credential went unnoticed, how much historical data was retained, and how clearly families were told about their exposure.

Why student data is a prime target

Children’s identities can be misused quietly for years before anyone notices. Schools often run with small IT teams, a mix of older systems and cloud services, and dozens of third-party vendors. And a single attack on a major vendor can reach hundreds of districts at once, which is exactly what happened here.

What districts should do now

1. Confirm your exposure

Ask PowerSchool, or any SIS vendor, for the specific data fields and years involved, and whether former students and staff were included.

2. Communicate clearly with families

Give a plain explanation of what happened, what data may be exposed, what families can do, and a contact for questions.

3. Lock down SIS and vendor access

• Require multi-factor authentication for every SIS user and for vendor support access.
• Remove inactive and former staff accounts and review administrator permissions.
• Limit and log vendor remote access.

4. Audit data retention

Review legal retention requirements, then archive or delete records the district no longer needs, and require deletion timelines in vendor contracts. Less retained data means less exposure in the next breach.

5. Strengthen vendor contracts

Require independent security audits such as SOC 2 Type II, multi-factor authentication for vendor staff, clear breach-notification timelines, liability for vendor-caused breaches, and data-minimization and deletion commitments.

6. Practice a breach response

Bring together technology, leadership, legal counsel, communications and board members to rehearse notifying families, locking down systems and working with state agencies.

7. Train everyone who handles student information

Teachers, office staff, coaches, substitutes and activity advisers all have logins, and any one of them can be an entry point.

8. Review cyber insurance

Check whether your policy covers breaches caused by vendors, forensic work, legal costs and credit monitoring for families.

Frequently asked questions

What happened in the PowerSchool data breach? In December 2024 an attacker used a stolen credential to access PowerSchool’s support portal and take student and teacher data from thousands of school districts’ systems.

How many students were affected? PowerSchool has not confirmed a total. Reports based on the hacker’s claims put it at about 62 million students and 9.5 million teachers.

Who was responsible? Matthew D. Lane of Massachusetts, who was sentenced to four years in federal prison in October 2025.

Is there a PowerSchool settlement? Not for the breach as of October 2026; the national lawsuit is in discovery. A separate $17.3 million settlement concerns tracking in PowerSchool’s Naviance software.

WRAL – Cybersecurity expert warns impacts of PowerSchool data breach may not be over (Play video)

Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.

More on Cybersecurity