The PowerSchool Breach May Have Compromised Over 70 Million Users' Data

Major data breaches and cybersecurity threats are now a fact of life, the consequence of which is our personal information being exposed at some point. One of the latest significant leaks involves data from PowerSchool, a software provider for thousands of K–12 school districts in the United States and Canada. The incident affected millions of users.

What happened in the PowerSchool hack

According to reports, PowerSchool discovered that personal information had been stolen from its customer support platform on Dec. 28, 2024. Hackers used compromised credentials to log into and export from its "Students" and "Teacher" database.

BleepingComputer is reporting that the hack may have compromised the personal data of 62.4 million students and 9.5 million teachers across 6,505 school districts. The stolen data includes contact information (such as names and addresses) as well as birthdates, Social Security numbers, medical information, and grades, though the specifics vary across affected districts. PowerSchool believes that fewer than 25% of individuals had their Social Security numbers stolen.

While the incident was not a ransomware attack, PowerSchool has stated that the company paid the hackers to prevent the compromised data from being published. The company began notifying affected customers on Jan. 7, 2025.

What you can do if your data was stolen

As I've written before, you can't take back information that's been leaked—and since your data has almost inevitably been compromised at some point, the best you can do is to be on the lookout for any signs that said data is being used in a malicious way. This includes keeping tabs on your credit report and sensitive accounts for unfamiliar or fraudulent activity and considering credit monitoring and identity protection services that will notify you of anything suspicious.

For those affected by this recent hack, PowerSchool is offering two years of identity protection services to all students and teachers (regardless of whether your Social Security number was compromised) through Experian. The company will also cover two years of credit monitoring for anyone over 18. According to a Jan. 17 update on the incident, PowerSchool and Experian will communicate with customers—including parents and guardians of students under 18—in the coming weeks about setting up these services.

Of course, you should also follow other basic security best practices: Don't click strange links or engage with communication asking for your personal information. When in doubt, hang up the phone, delete the text, or flag the email as spam, and contact the company directly to confirm any requests. (Note that PowerSchool will not contact you directly by phone or email to request or confirm your personal information.)