Education technology giant PowerSchool told customers it had experienced a “cyber security incident” that allowed hackers to compromise personal data of students and teachers at K-12 school districts across the United States.
California-based Power School, which was Acquired by Bain Capital in 2024 for $5.6 billionThe largest provider of cloud-based education software for K-12 education in the United States, serving more than 75% of students in North America, according to the company's website. PowerSchool says its software is used by more than 16,000 customers to support more than 50 million students in the United States.
In a letter sent to affected customers on Tuesday, Dr Published in a local newsPowerSchool said it discovered on Dec. 28 that hackers had successfully breached its PowerSource customer support portal, allowing more access to the company's school information system, PowerSchool SIS, which schools use to manage student records, grades, attendance and enrollment. The letter states that the company's investigation found that the hackers gained access “using a compromised certificate.”
PowerSchool did not say what kind of data it accessed during the incident or how many people were affected by the breach, and neither PowerSchool nor Bain Capital responded to TechCrunch's questions.
The nature of the cyber attack remains unknown. Bleeping computer In an FAQ sent to affected users, PowerSchool said it had not experienced a ransomware attack, but the company extorted For financial payments to prevent hackers from leaking stolen data. PowerSchool told the publication that names and addresses were exposed in the breach, but the information could also include Social Security numbers, medical information, grades and other personally identifiable information. PowerSchool did not say how much the company paid.
Power was the school Lawsuit by class action in November 2024, which alleged that the company illegally sold student data without consent for commercial gain. According to the lawsuit, the company's student data totaled “345 terabytes of data collected from 440 school districts.”
“PowerSchool collects this highly sensitive information under the guise of educational support, but actually collects it for its own commercial gain,” while “hiding behind opaque terms of service that no one can understand,” the lawsuit alleges.