PowerSchool

PowerSchool, a technology service provider for school districts, reported a cybersecurity incident in Maryland affecting approximately 145,783 residents. The incident occurred between December 19 and December 28, 2024, involving unauthorized exfiltration of personal information (names, SSNs, DOBs, limited medical alerts) via a customer support portal. PowerSchool engaged forensic experts and law enforcement, and is offering credit monitoring through Experian.

PowerSchool disclosed a cybersecurity incident discovered on Dec 28, 2024, involving unauthorized exfiltration of personal data from its Student Information System via a customer support portal. Affected data included names, DOBs, SSNs, and limited medical alerts. Approximately 92,028 individuals were affected across multiple school districts. PowerSchool engaged forensic experts and offered two years of identity protection and credit monitoring.

PowerSchool Group LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2024-12-19 and was reported on 2025-01-29. 2,103,269 Indiana residents were affected.

PowerSchool Group LLC disclosed a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System (SIS) via the PowerSource customer support portal. Affected data included names, contact info, DOB, SSNs, and limited medical alert info. PowerSchool offered two years of complimentary identity protection and credit monitoring to affected students and educators.

PowerSchool Group, LLC experienced a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System (SIS) via the PowerSource customer support portal. Affected data included names, contact info, dates of birth, Social Security Numbers, and limited medical alert information. PowerSchool engaged third-party forensic experts and offered two years of complimentary identity protection and credit monitoring to affected students, educators, and parents.

PowerSchool disclosed a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System (SIS) via the PowerSource customer support portal. Affected data included names, contact info, DOB, SSNs, and limited medical alert info. PowerSchool engaged forensic experts and offered two years of complimentary identity protection and credit monitoring to affected students and educators.

PowerSchool notified the Rhode Island Attorney General of a cybersecurity incident occurring between Dec 19-28, 2024. Unauthorized actors exfiltrated personal information from the PowerSource support portal, affecting ~6,766 RI residents. Data included names, SSNs, DOBs, and medical alerts. PowerSchool engaged forensic experts, reported to law enforcement, and offered two years of credit monitoring via Experian.

PowerSchool Group LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-01-28. 18,476 Massachusetts residents were affected.

PowerSchool disclosed a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System via a customer support portal. Affected data included names, contact info, DOB, SSNs, and limited medical alert info. PowerSchool engaged forensic experts and offered two years of identity protection and credit monitoring.

PowerSchool, a technology service provider to school districts, notified the Iowa Attorney General on January 27, 2025, of a cybersecurity incident discovered on December 28, 2024. Unauthorized actors exfiltrated personal information from the PowerSchool Student Information System (SIS) via the PowerSource support portal between December 19 and 28, 2024. Approximately 49,921 Iowa residents (students, former students, and teachers) were affected. Data included names, contact info, SSNs, dates of birth, and limited medical alert information. PowerSchool engaged forensic experts, reported to law enforcement, and offered two years of credit monitoring via Experian.

PowerSchool Group LLC reported an external system breach (hacking) occurring between Dec 19-28, 2024, discovered on Dec 28, 2024. Unauthorized exfiltration of personal information (names, DOB, SSNs, limited medical alerts) occurred via the PowerSource customer support portal. Notification sent Jan 29, 2025. Affected individual count is to be determined. Two years of identity protection/credit monitoring offered via Experian.

PowerSchool disclosed a cybersecurity incident on December 28, 2024, involving unauthorized exfiltration of personal information from its Student Information System via the PowerSource support portal. Data types included names, contact info, DOB, SSNs, and limited medical alert info. PowerSchool engaged forensic experts and is offering two years of complimentary identity protection and credit monitoring to affected students and educators.

PowerSchool notified the Idaho Attorney General on January 27, 2025, of a cybersecurity incident occurring between December 19 and 28, 2024. Unauthorized actors exfiltrated personal information from the PowerSchool Student Information System (SIS) via the PowerSource support portal. Approximately 29,074 Idaho residents (students, former students, and teachers) were affected. Data included names, contact info, SSNs, dates of birth, and limited medical alerts. PowerSchool engaged forensic experts, reported to law enforcement, and offered two years of credit monitoring via Experian.

PowerSchool Group LLC disclosed a cybersecurity incident where unauthorized exfiltration of personal information occurred from its Student Information System environments via the PowerSource support portal. The breach window is December 19-28, 2024, with discovery on December 28, 2024. Affected data includes names, contact info, dates of birth, SSNs, and limited medical alerts for students and educators. PowerSchool engaged third-party experts and is offering identity protection and credit monitoring.

PowerSchool, a technology service provider to school districts, disclosed a cybersecurity incident affecting approximately 9,384 New Hampshire residents. The unauthorized exfiltration of personal information (including names, SSNs, and dates of birth) occurred between December 19 and December 28, 2024, and was discovered on December 28, 2024. PowerSchool engaged forensic experts, notified law enforcement, and is offering two years of credit monitoring and identity protection services.

PowerSchool Group LLC reports a cybersecurity incident where personal information of Washington residents was exfiltrated from its cloud environment via a customer support portal. The incident occurred between Dec 19-28, 2024, and was discovered on Dec 28, 2024. Data types included names, DOBs, SSNs, and medical alerts. 314,107 Washington residents were affected. PowerSchool engaged forensic experts and offered credit monitoring.

PowerSchool Group LLC reported a data breach to the Oregon Attorney General. The breach was reported on 2025-01-27. The breach occurred during 12/19/2024 - 12/28/2024. The breach was discovered on 12/28/2024. 0 individuals were affected. Notice was sent on 1/1/0001.

Idaho AG received supplemental notice from PowerSchool regarding a cybersecurity incident occurring between Dec 19-28, 2024. Personal information of state residents (students/teachers) was exfiltrated, including names, DOB, SSN, and limited medical alerts. PowerSchool estimates 84% of Idaho customers are hosted; on-prem customer data is excluded from this notice.

PowerSchool reported a data breach to the Wisconsin DATCP. The public was notified on 2025-01-07. The incident occurred on Between December 19 and December 28, 2024. Data accessed: Individuals' names, contact information, dates of birth, limited medical alert information, Social Security numbers, and other related information.

POWERSCHOOL filed a data-breach notice with the Illinois Attorney General in January 2025 (case 25-01-077). The register records the breach as discovered on December 19, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.