PowerSchool Data Breach: What Parents Should Do
A breach at a school software vendor can expose children’s records without any school having done anything wrong. Here is what was reported and how to protect a child.
By Siddharth ShankarUpdated October 20, 2026PowerSchool detected unauthorised access on December 28, 2024 after attackers used compromised credentials on its PowerSource support portal. Exposed data for some people included names, contact details, Social Security numbers, medical alerts and academic records. A hacker’s claim of tens of millions of records is unverified, and PowerSchool says not all customers were affected. It offered two years of Experian identity protection or credit monitoring. Parents should enrol, consider a credit freeze for the child and watch for scams.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
PowerSchool provides software that many schools use for grades, attendance and student records. When a vendor like this is breached, parents may get a notice about a company they have never dealt with. That is what happened here.
What happened
According to CyberInsider’s report, PowerSchool detected the incident on December 28, 2024. The company said the attacker got in using compromised credentials for its PowerSource customer support portal. It later reported paying a ransom to prevent the data from being released.
What data may be affected
PowerSchool said the exposed information varied by school district. For some individuals it included:
- Names and contact information
- Social Security numbers
- Medical alert information
- Academic and grade records
Not every person had every item exposed. Your school or district notice says what applies to your child.
How many people?
A hacker claimed to have records on 62.4 million students and 9.5 million teachers. That figure is unverified, and PowerSchool has said not all customers were affected. Treat the claim as an unconfirmed upper bound and rely on your own district’s notice.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
What PowerSchool offered
PowerSchool offered two years of identity protection and credit monitoring through Experian. Adults are offered credit monitoring, and minors are offered identity protection, since children usually have no credit file. The notice from your district explains how to enrol.
What parents should do
1Read the notice
Check what was exposed for your child, and who it came from. If unsure it is real, contact the school using a number you already have. See how to tell if a breach notice is real.
2Enrol in the free protection
Use the enrolment steps in the notice. It costs nothing.
3Freeze your child’s credit
A child normally has no credit file, so a freeze blocks anyone opening credit with the child’s Social Security number. See synthetic identity fraud for why this matters.
4Check statements and credit
Review your own accounts, and look for credit activity in a child’s name.
5Be careful with school-themed messages
Scammers send fake messages about grades, fees or this breach. Do not click links or give details by phone.
Talking to your child about it
Older children may hear about the breach at school and worry. Explain in plain terms that a company that handles school records was attacked, that you are taking steps to protect them, and that they can help by being careful with messages. Remind them not to share passwords or codes with anyone, including friends, and to tell you if someone asks for personal details online.
Questions to ask your school
- Which categories of my child’s data were involved in this incident?
- Has the school received a notice from the vendor, and what does it say?
- What data does the school share with vendors, and is any of it optional?
- How long is student data kept after a child leaves?
- Who should I contact with further questions?
Asking these questions does not assign blame. It encourages the school to review what it collects, which is the idea behind data minimisation.
What you can control
You cannot choose which software your school uses. You can limit what you give out, ask what data your school collects and why, and teach children about scams. See a parents’ guide to a child’s digital footprint and what sharenting is.
Sources
- CyberInsider: PowerSchool notifies students and educators of major data breach (December 28, 2024, compromised credentials, data types, hacker claim, ransom, Experian offer)
Frequently asked questions
When was PowerSchool breached?
PowerSchool detected the incident on December 28, 2024.
How did the attackers get in?
Through compromised credentials for its PowerSource customer support portal.
What data was exposed?
For some people: names, contact details, Social Security numbers, medical alerts and academic records.
Was the 62 million figure confirmed?
No. It was a hacker’s claim, and PowerSchool says not all customers were affected.
What did PowerSchool offer?
Two years of Experian identity protection or credit monitoring, depending on age.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.