INCIDENT REPORT · CP-2024-012

PowerSchool student information system data breach

L3 · ELEVATEDCONFIRMED

Education software provider PowerSchool discovered on 28 December 2024 that an attacker had used a compromised credential to access its support portal and export student and teacher data. Customers were notified in January 2025.

Incident ID: CP-2024-012
Incident date: 28 DEC 2024
Detection date: 28 DEC 2024
Affected countries: United States
Plotted location: Folsom, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Very large theft of children's and educators' personal data across many school districts; no operational disruption.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Compromised credential used to access PowerSource, PowerSchool's customer support portal, which held a maintenance tool with access to customer data
Sectors: Education, Technology
Critical infrastructure: No
Organizations affected: PowerSchool, School districts using PowerSchool SIS
Operational consequences: Student and teacher data from many US school districts was stolen and used for extortion. Reported totals of affected people vary between sources, with figures above 60 million.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the US Department of Justice to Matthew D. Lane, a Massachusetts student who agreed in May 2025 to plead guilty to cyber extortion and related charges

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

PowerSchool student information system data breach

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2024-012

Incident date

28 DEC 2024

Detection date

28 DEC 2024

Affected countries

United States

Plotted location

Folsom, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Very large theft of children's and educators' personal data across many school districts; no operational disruption.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Compromised credential used to access PowerSource, PowerSchool's customer support portal, which held a maintenance tool with access to customer data

Sectors

Education, Technology

Critical infrastructure

Organizations affected

PowerSchool, School districts using PowerSchool SIS

Operational consequences

Student and teacher data from many US school districts was stolen and used for extortion. Reported totals of affected people vary between sources, with figures above 60 million.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the US Department of Justice to Matthew D. Lane, a Massachusetts student who agreed in May 2025 to plead guilty to cyber extortion and related charges