PowerSchool Faces 23 Lawsuits Over Schools’ Mega Data Breach

Educational software-maker PowerSchool faces at least 23 lawsuits seeking class-action status, filed in the wake of a massive data breach involving student and faculty data.

See Also: Discover Strategies to Combat Compromised Credential Attacks

The Folsom, California company began warning multiple schools and districts around Jan. 8 that an attacker stole student and faculty database tables from the PowerSchool student information system platform sometime between Dec. 10 and Dec. 28, 2024.

Each of the lawsuits, filed in U.S. District Court for the Eastern District of California, seeks to represent a nationwide class of affected current and former students and faculty whose personally identifiable information or personal health information were exposed in the breach.

The breach appears to have resulted in the theft of information from school districts across the U.S., Canada as well as the self-governing British overseas territory Bermuda.

PowerSchool declined to comment on the lawsuits. The full extent of the breach isn’t yet clear. PowerSchool’s investigation, spearheaded by CrowdStrike, remains active. The company said its software stores information of 60 million K-12 students and teachers across more than 18,000 customers, including over 90 of the top 100 districts by student enrollment in the U.S. Bain Capital closed a deal last October to acquire the company for $5.6 billion, taking it private.

Exposed information included whatever was being stored in any given breached school’s SIS database, typically including name, contact details, date of birth, medical alert information and Social Security numbers. “Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base,” PowerSchool said.

Remote Access Questions

The company has not committed to publishing a full root-cause analysis of the breach, as some other organizations have done following a major security incident, such as CrowdStrike after its software triggered a global outage in July 2024.

“Our investigation into this incident is ongoing; however, evidence indicates that an unauthorized party was able to use a compromised credential to access one of our community-focused customer support portals, PowerSource,” a PowerSchool spokesperson told Information Security Media Group. “We have restricted all access to the affected portal.”

Customers said this appears to have involved moving the portal behind a VPN and implementing multi-factor authentication to access it. Some have criticized the company for failing to do that in the first place, as well as building a feature allowing an authorized, remote user to bypass their local security controls, something critics say is tantamount to a backdoor.

“We as customers didn’t realize that PowerSchool had a built-in feature to their product called ‘remote maintenance’,” one IT administrator for an affected school district that sports nearly 5,000 current students told ISMG, speaking on condition of anonymity. “This allowed access to the administrative portion of the web interface for the product directly to PowerSchool’s support. The remote maintenance access bypassed our own internal authentication scheme, which enforces MFA. It appears this remote access was granted via PowerSchool’s PowerSource remote support tool, which again was open to the public internet and not authenticated with MFA.”

PowerSchool disputed characterizing PowerSource as a backdoor. “PowerSource is used for advanced technical customer assistance and data management across our PowerSchool SIS customer base. PowerSource is a tool familiar to many of our customers used by our maintenance teams to support customers for over a decade,” a PowerSchool spokesperson told Information Security Media Group. “The tool is enabled during the implementation process of a customer’s platform. After, customers can elect to disable maintenance access and some customers choose to do so, while others do not.”

“That may be true but we implemented PowerSchool in 2008, and we had a much different concept of security back then,” the IT administrator responded. “Remember, this resides inside of their web application. Most customers after this incident, including us, have gone the six or seven menus in and disabled this tool, but neither I nor our current SIS admin were aware the tool existed and she has attended multiple PowerSchool trainings.”

How Many Breach Victims?

One lawsuit asserts that any class action lawsuit would comprise “more than 827,000 individuals” affected by the breach.

That figure “is likely an underestimate,” Mark Racine, who from 2013 to 2024 served as CIO of Boston Public Schools, said in a blog post for the K12TechPro.com online community.

Some districts have reported that the total number of individuals affected by the breach is 4 to 10 times higher than their current enrollment. The SIS system retains data related to former students and faculty, he said. “For example, South Carolina, which uses PowerSchool for its entire state, has about 800,000 active students this year. Each historical year stored in PowerSchool would add around 60,000 students, and South Carolina represents less than half a percent of PowerSchool’s customer base.”

Or as Wisconsin’s Hurley School District warned: “We started using PowerSchool in 2009, so any information from students who were enrolled that year and up until the present could be compromised.”

Security experts have questioned why the system continued to retain data on former students and faculty. Some laws, such as the California Consumer Privacy Act, mandate data minimization by requiring that businesses only collect, use, retain or share a consumer’s personal information if doing so is “necessary and proportionate to achieve the purposes for which the personal information was collected or processed.” But the CCPA applies to for-profit schools, not the public sector.

Early communications from PowerSchool highlighted that the private business paid a ransom to attackers in return for their promise to delete stolen data. Security experts and law enforcement agencies continue to urge breached organizations to never pay ransoms for abstract promises. They say there’s no evidence any criminal has ever deleted stolen data, while evidence of the opposite abounds (see: PowerSchool’s Breach Fallacy: Paying Criminals for Promises).

Racine said there are “silver linings” tied to the attack due to it only involving data exfiltration, rather than system-level disruption – for example, if the attacker had attempted to encrypt or delete schools’ SIS database tables.

“School districts depend on their SIS for student safety and school operations, and we would have been talking about school cancellations if PowerSchool’s availability had been impacted,” he said.