PowerSchool data breach: what happened and what to do
Last reviewed September 4, 2025 · 9 records on file · sources listed below
Data breach at education software provider PowerSchool exposed personal and health information of over 880,000 Texas students and teachers. Texas Attorney General filed lawsuit alleging failure to encrypt sensitive data and ignoring basic cybersecurity protocols.
If you have an account with PowerSchool, assume the exposed details are circulating. The practical risk today is rarely the leak itself — it is the calls and messages that use those details to sound legitimate.
What we have on file
Every entry below is a catalogued record with its original source. We do not paraphrase beyond what the source reports.
Student Information · Unknown
The federal privacy watchdog discontinued an investigation into a cybersecurity breach involving a student information system used across Canada, citing satisfaction with the company's response and added security measures.
Student Information · Hacking
A Massachusetts college student pleaded guilty to hacking PowerSchool, a cloud-based education software provider, and stealing data pertaining to millions of North American students and teachers. The stolen data was used to extort the company and school districts into paying ransoms.
Health Information · Unknown
Powerschool, an education software company, reported a data breach affecting 18,476 Massachusetts residents, with Social Security numbers and medical records being compromised.
Student Information · Unknown
A massive data breach at PowerSchool, an app used by schools to track student attendance and other information, potentially affected 70 million individuals. The breach was disclosed via an email from a school district, but details about the breach method remain unclear.
Student Information · Hacking
A hack of PowerSchool, a company that helps schools track student information, resulted in the largest breach of American children's personal information to date. The breach exposed sensitive student data.
Student Information · Unknown
A cyber breach affecting some school boards across Canada may have given unauthorized users access to student information, including personal details.
Student Information · Hacking
A hacker accessed PowerSchool's internal systems as far back as August, leading to a massive data breach in December. The breach exposed student information, and the incident was investigated by cybersecurity firm CrowdStrike.
Student Information · Ransomware
Canada's largest school board and others across North America received ransom demands connected to the PowerSchool cybersecurity breach that occurred during the winter break. Despite the company paying a ransom, hackers still hold millions of student records, including personal information of children.
What to do
- Change the password anywhere you reused itThe exposure matters most when the same password protects your email, because email is how everything else gets reset.
- Treat every call and text about this breach as a scam until proven otherwiseNo company will ask you for a one-time code, a PIN or a password. Hang up and call the number printed on your card.
- Read your statements for the next three monthsCard fraud usually starts with a small test charge. Catching that one is what stops the large one.
- Give your email account a password nothing else usesIt is the account that can reset all the others, so it is the one worth protecting first.
Questions people ask
Was my data in the PowerSchool breach?
Having an account alone does not confirm exposure. The reliable check is whether your email address appears in the leaked datasets in circulation — that takes seconds and does not require your password.
Is it too late to do anything?
No. Leaked personal details do not expire, and neither does the defence: a unique password on your email, and a fraud alert on your credit file, still work years later.
Will PowerSchool contact me?
They may. But scammers contact people too, using exactly these breach details to sound convincing. Never act on an inbound call or text — call back on a number you already had.
701 organisations catalogued
Records are catalogued from public reporting and linked to their original source. iTellYou is not affiliated with the organisations listed. If you represent one of them and something here is inaccurate, write to us and we will correct it.