PowerSchool breach exposes K-12 student and teacher records worldwide

PowerSchool, a United States education software vendor whose student information system is used by school organisations in around 90 countries, said it learned on December 28, 2024 that an outsider had reached customer data held in its PowerSchool SIS product. It notified affected school districts on January 7, 2025.

According to the company, a single compromised credential was used to log into PowerSource, its customer support portal. Maintenance tooling available through that portal was then used to export database tables from certain SIS instances. PowerSchool characterised the event as an intrusion using stolen credentials rather than a ransomware attack or the exploitation of a software flaw, and said it had disabled the credential and engaged outside investigators.

The fields involved varied by district and included names, contact information, dates of birth, limited medical alert information and, in some cases, Social Security numbers, grades and other student records. The company said there was no evidence that credit card or banking information was affected.

Early coverage framed the exposure as potentially reaching more than 60 million students and teachers, an early estimate that was later broadly borne out. In a May 2025 guilty plea agreement, US prosecutors put the stolen databases at 62.4 million students and 9.5 million teachers from 6,505 school districts in the United States, Canada and other countries. PowerSchool said not all SIS customers were affected and did not publish a number at the time. It offered credit monitoring to affected adults and identity protection for students.