Archive — US — techcrunch
What PowerSchool won’t say about its data breach affecting millions of students
In January 2025, PowerSchool revealed a significant data breach impacting millions of students across North America, caused by a compromised credential. The breach allowed unauthorized access to sensitive information, but despite its scale, PowerSchool has not disclosed the exact number of affected individuals or detailed the types of data stolen. Important questions remain unanswered about the incident, including whether a ransom was paid and the identity of the hacker.
Key points
- PowerSchool provides software to 18,000 schools, affecting 60 million students.
- Breach occurred due to a compromised credential in December 2024, allowing access to sensitive data.
- Customer support portal lacked multi-factor authentication at the time of the breach.
- No firm numbers on affected individuals, but estimates suggest over 62 million students and 9.5 million teachers' data compromised.
- PowerSchool confirmed data stolen may include sensitive personal information like grades and Social Security numbers.
- Questions about ransom payments and evidence of data deletion remain unresolved.
- CrowdStrike report highlights a lack of clarity about the breach duration and causes.
Why it matters
- The breach reflects growing concerns over cybersecurity in edtech, a sector facing rapid digital transformation.
- By 2025, trends in IT emphasize increasing investment in security solutions, highlighting the need for better protection against breaches.
- Historical data breaches in education, such as the 2020 Blackbaud incident, underline the sector's vulnerability to cyberattacks.
The PowerSchool data breach serves as a critical reminder of the need for enhanced cybersecurity measures in educational technology, as millions remain vulnerable due to insufficient protections and transparency from service providers.