The Stillwater school district was affected by the PowerSchool breach, according to its director of information technology. The district, which has about 8,500 students, immediately launched its own forensics investigation, he said. Shown is Stillwater High School in 2024. (Shari L. Gross/The Minnesota Star Tribune)
Most U.S. schools use third-party vendors such as PowerSchool to run their student information portals, said Levin from the cybersecurity nonprofit. Student information systems contain all sorts of data, including grades and attendance.
“It is essentially who the student is, who their teachers are and who their parents are — sort of the crown jewels of student information,” Levin said.
PowerSchool has 18,000 customers in 90 countries, including more than 90 of the 100 U.S. largest school districts, according to Bain Capital, a private equity firm that bought PowerSchool for $5.6 billion in October 2024.
PowerSchool says on its website that it took “immediate action” to contain the data breach, auditing and bolstering its security systems. The company has offered complimentary identity protection services to breach victims.
PowerSchool declined to comment beyond its online statements.
PowerSchool became aware on Dec. 28 that hackers had extracted data between Dec. 19 and Dec. 23, according to a report by cybersecurity firm Crowd Strike, which is posted on PowerSchool’s website.