On January 7, PowerSchool disclosed a data breach that exposed the personal information of students and teachers across K-12 schools in the U.S., raising serious concerns about cybersecurity in education. [TechCrunch] 

Driving the news: The breach, identified on December 28, 2024, compromised PowerSource, a customer support portal, and allowed hackers access to PowerSchool’s Student Information System (SIS), which stores sensitive information like student grades, attendance, and staff records. [Education Week, subscription model] 

  • PowerSchool supports more than 50 million students and 16,000 schools across North America, making the breach’s impact significant. 
  • Hackers gained access through a compromised credential, though the company has not disclosed how many individuals were affected.

Why it matters: Schools are increasingly vulnerable to cyberattacks due to the extensive data they store and their growing reliance on digital tools.

  • Potentially exposed information includes names, addresses, Social Security numbers, medical records, and academic data, though PowerSchool has not confirmed the full scope of the breach. 
  • Cyberattacks on schools are rising, with 80% of school IT professionals reporting ransomware incidents in recent years​.

The response: PowerSchool has taken several steps to address the breach and mitigate its impact. The company deactivated the compromised account and implemented stricter password and access controls to prevent further unauthorized access. It is offering credit monitoring services to affected adults and identity protection services to impacted minors. 

  • Additionally, PowerSchool stated that the breach is now contained and that it does not anticipate further unauthorized data exposure. The company has notified law enforcement and is cooperating with investigations to ensure accountability and transparency in resolving the incident​. 

​The bottom line: This breach highlights the critical need for robust cybersecurity in education, with schools and software providers bearing a shared responsibility to protect sensitive data.