PowerSchool hacker claims they stole data of 62 million studentsPowerSchool hacker claims they stole data of 62 million students

In late December 2024, PowerSchool, the dominant provider of student information systems for K-12 schools in North America, discovered that an intruder had exported data from customer databases. The company began alerting school districts in early January 2025. An extortion demand reviewed by BleepingComputer later claimed the theft covered about 62.4 million students and 9.5 million teachers across roughly 6,500 school districts in the United States, Canada and elsewhere. PowerSchool, acquired by private equity firm Bain Capital in 2024 in a deal valued at about $5.6 billion, serves more than 18,000 customers worldwide, from small rural systems to some of the largest districts in North America.

The attacker logged into PowerSource, PowerSchool's customer support portal, using credentials belonging to a subcontractor, and then abused a remote maintenance tool to connect to school districts' PowerSchool SIS instances and download their data. Security researchers and later reporting noted that the account did not require multi-factor authentication. Among the largest affected districts were the Toronto District School Board, Peel District School Board and Dallas Independent School District.

The stolen tables varied by district but included names, contact details, birthdates, parent information, grades, and in some cases medical notes and Social Security numbers. PowerSchool said more than three quarters of affected people did not have Social Security numbers exposed, and it offered free identity protection and credit monitoring to students and staff.

PowerSchool paid a ransom in exchange for a video purporting to show the data being deleted. That assurance proved hollow: beginning in May 2025, criminals contacted individual school districts, threatening to publish student data unless they paid. A 19-year-old Massachusetts college student, Matthew Lane, pleaded guilty to federal charges tied to the attack. In September 2025, Texas Attorney General Ken Paxton sued PowerSchool, citing roughly 880,000 affected Texans, and numerous class actions were filed on behalf of families and educators.

The breach is among the largest ever involving children. Because minors rarely monitor their credit, stolen identifiers can be used for years before anyone notices. It also illustrated the risk of concentrating an entire sector's records in one vendor and the limits of paying extortionists, whose promises to delete data cannot be verified.