PowerSchool Breach 2025: Which Districts Were Affected

The PowerSchool breach of December 2024–January 2025 exposed the personal records of an estimated 60 million students and 10 million teachers across 18,000 school districts in the United States and Canada — making it the largest breach of K-12 education data in history. The attacker accessed PowerSchool's Student Information System (SIS) — the administrative platform that tracks student enrollment, grades, attendance, and sensitive family information — using compromised credentials on a customer support portal.

What made the breach particularly damaging was the subsequent extortion campaign: after school districts paid ransom to prevent data publication, PowerSchool's threat actor returned with fresh extortion demands directly against individual districts months later, demonstrating that ransom payments had not produced data deletion.

The attacker gained access to PowerSchool's PowerSource customer support portal in late December 2024 using stolen credentials. From PowerSource, they accessed PowerSchool's Student Information System database, exfiltrating records containing student names, dates of birth, addresses, Social Security numbers, medical information, and academic records. In some districts, teacher data was also stolen. PowerSchool discovered the breach in January 2025 and paid the attacker to delete the data, receiving a video purportedly showing deletion. By mid-2025, multiple school districts reported receiving fresh extortion demands from the same threat actor, indicating the deletion video was falsified. The scope — 60 million student records across 18,000 districts — reflected PowerSchool's position as the dominant K-12 SIS platform in North America.

The attacker used stolen credentials for PowerSchool's PowerSource customer support portal. The portal had access to the production SIS database for support purposes — the access that was intended for troubleshooting customer issues provided the mechanism for bulk data exfiltration. PowerSchool acknowledged that the compromised account did not have MFA enabled. The data exfiltration used a maintenance access tool that allowed bulk export of student records. The attack vector — compromised credentials on a support portal with broad production database access — is a specific risk category that many SaaS vendors have failed to adequately control.

For PE sponsors with edtech, SaaS, or software portfolio companies, PowerSchool established that customer support portal access controls are a material security investment, not an administrative detail. Any SaaS company whose support infrastructure can access production customer data must implement MFA, session monitoring, and data export controls on those access points. The re-extortion campaign also reinforces the lesson that data exfiltration liability is permanent — paying ransom does not transfer or eliminate it.

Which Districts Were Affected

PowerSchool never published a customer list. Federal charging documents put the scale at roughly 62.4 million students and 9.5 million teachers across about 6,505 districts, but the company itself has never confirmed a figure or named a single district. What follows is assembled from district notices, state education departments, and local reporting. Every entry below has a public source behind it.

If your district is not listed, that is not evidence it was unaffected. It means no public confirmation was found. Contact the district directly.

If You Are Looking for Juneau, Read This First

On January 10, 2025, PowerSchool told the Juneau School District it had not been affected. Local coverage reported exactly that, and those articles are still circulating.

Four days later, PowerSchool reversed itself. After finding suspicious activity in data logs, the company confirmed that Juneau was affected. Anyone who attended or worked at JSD from the 2008-09 school year onward is in scope. The district does not store Social Security numbers, driver's license numbers, or credit card data in PowerSchool, so those were not exposed.

If you read that Juneau was clear, you read the first story and not the correction.

If You Are Looking for Franklin County, Georgia

There is no evidence that Franklin County Schools in Georgia was affected. The district uses Infinite Campus rather than PowerSchool, so it would not have been in scope.

The search volume is almost certainly a name collision. Several other Franklin Counties are involved:

• Franklin Regional School District (Pennsylvania) confirmed affected
• Franklin County Community School Corporation (Indiana) published a breach notice
• Franklin County Schools (North Carolina) not individually named, but North Carolina mandated PowerSchool statewide, so it is almost certainly in scope
• Franklin County Public Schools (Virginia) uses PowerSchool, but no breach confirmation was found

If You Are Looking for Simsbury, Connecticut

Simsbury reported that it was not impacted. The superintendent relayed PowerSchool's finding that "our thorough forensic investigation has confirmed that your organization's data was not impacted." Simsbury does not appear on independent lists of affected Connecticut districts. That said, this rests on the district relaying the vendor's own assessment, and the Juneau reversal is a reminder that those assessments changed.

Confirmed Affected Districts

Statewide and Near-Statewide Exposure

North Carolina. The state mandates PowerSchool for all districts, so exposure runs across all 100 counties for anyone in the system since 2013. Roughly 312,000 teacher Social Security numbers and 910 student Social Security numbers were exposed. Named districts include Wake County Public School System, Wayne County Public Schools, Union County Public Schools, and New Hanover County Schools.

South Carolina. The state Department of Education said every district appeared on the impact list except four: Edgefield County, Greenville County, Horry County, and Richland School District Two. SCDE cautioned that appearing on the list means the system was accessed, not necessarily that data was extracted. Bamberg County Schools and the South Carolina Department of Juvenile Justice school district separately confirmed impact.

Virginia. Up to 85 divisions in the Virginia PowerSchool Users Group were potentially affected. Named: Fluvanna County, Charlottesville, Richmond County, Tazewell County, Russell County.

Texas. An attorney general filing put the figure at nearly 800,000 residents. No individual districts were named publicly.

Maine. An attorney general filing put the figure at 33,488 residents. Named districts include Brunswick, Cumberland, Gardiner, and Yarmouth.

Massachusetts

• Public Schools of Northborough and Southborough student and staff exports taken, including medical alerts and physician information. Social Security numbers generally not exposed. Medical records and custody documents were stored separately and were not compromised.
• Pittsfield, Lenox, North Adams, Central Berkshire Regional, Berkshire Hills Regional names, addresses, family contacts, medical alerts

Alaska

• Juneau School District all students and staff from 2008-09 onward. No Social Security numbers stored.
• Lower Kuskokwim School District 14,102 student records, roughly 87 percent including Social Security numbers, plus more than 3,000 staff records. Data back to 2003.
• Lower Yukon School District, Nome Public Schools, Bering Strait School District

Connecticut

• Sterling 261 students had Social Security numbers compromised
• Wallingford, Berlin, Cromwell, Montville, Newington, Region 16, Colchester, Rocky Hill, Southington, Regional School District 1
• Connecticut Technical Education and Career System impact described as limited

Illinois

• Lake Forest District 115 10,244 student and 1,204 staff records, 2013 to 2024
• Lake Forest District 67 7,730 student and 820 staff records, 2013 to 2024
• Burbank District 11, Oswego CUSD 308, CCSD 146, Mundelein High School District 120, Beach Park District 3, Harvey District 125, Lincolnshire-Prairie View District 103, North Chicago District 187, Prospect Heights District 23, Zion Elementary District 6

California

• Menlo Park City School District 10,662 students and 3,270 staff. 386 pre-2018 student records contained Social Security numbers.
• Portola Valley School District all current and former staff had Social Security numbers exposed
• Rancho Santa Fe School District teacher credentials and Social Security numbers

Other States

• Minnesota St. Louis Park (about 5,000 students), Stillwater Area (about 8,500), Caledonia (about 700), Braham, Sauk Centre
• Colorado Colorado Springs District 11, Manitou Springs District 14, School District 49
• Pennsylvania Penn-Trafford, Franklin Regional, Fox Chapel Area, Central Pennsylvania Institute of Science and Technology
• Ohio North Olmsted, Shaker Heights
• New York Massapequa School District (students and staff since 2009). In New York City, the education department declined to name schools; the state education department identified Fordham High School for the Arts, Long Island City High School, Lower East Side Prep, and Westchester Square Academy, covering roughly 3,000 currently enrolled students whose exposed data included Social Security numbers.
• Tennessee Memphis-Shelby County Schools, the state's largest district at 110,000 students
• Idaho West Ada School District
• New Hampshire and Vermont Claremont, Newport, Rivendell Interstate

Canada

• Toronto District School Board approximately 1.49 million current and former students, with records going back to 1985. Students from 1985 to 2017 had health card numbers, addresses and phone numbers exposed. Students from 2017 to 2024 had medical information, principal's notes and dates of birth exposed.
• Ontario Peel District School Board, Durham District School Board, York Region District School Board, London District Catholic School Board, Ottawa Catholic School Board
• Alberta Calgary Board of Education
• Nova Scotia Cape Breton-Victoria Regional Centre for Education, 35,000 current and former students
• Manitoba more than 21 school divisions, including Brandon, Flin Flon, Louis Riel and Seine River

The Extortion Did Not End When PowerSchool Paid

PowerSchool received a ransom demand of roughly $2.85 million in Bitcoin on December 28, 2024, and paid it. The company obtained a video purporting to show the data being deleted, along with what it described as reasonable assurances. It conceded at the time that there was no guarantee.

There was no guarantee, and the assurance did not hold.

In May 2025, roughly four months after the payment, a threat actor began extorting individual districts directly, threatening to publish the same stolen student and teacher data. PowerSchool confirmed it, saying it regretted that customers were "being threatened and re-victimized." The Toronto District School Board publicly confirmed receiving a demand. North Carolina's Department of Public Instruction confirmed that 20 districts had been emailed by threat actors but declined to name them.

Matthew D. Lane, a Massachusetts college student who was 19 at the time of charging, pleaded guilty to four federal counts including cyber extortion conspiracy and aggravated identity theft. He had used a PowerSchool contractor's credentials. He was sentenced to four years in prison, three years of supervised release, $14.1 million in restitution and a $25,000 fine, roughly half the eight years prosecutors sought. Approximately $3 million in proceeds remains unaccounted for.

Whether Lane was personally responsible for the May 2025 wave of district-level extortion, or whether the data had already been passed on or resold, has not been established publicly.

What Families Were Offered

PowerSchool provided two years of identity protection through Experian to all affected individuals, and two years of credit monitoring to adults. Minors were eligible for identity protection only, because credit bureaus do not offer credit monitoring to people under 18. A child who turned 18 during the coverage window could then enroll in credit monitoring for the remainder.

Districts where Social Security numbers were exposed generally notified those individuals directly.

Enrollment deadlines have now passed. Anyone who believes they were affected and did not enroll should contact their district rather than PowerSchool.

The Executive Lesson

This was not ransomware. Nothing was encrypted. An attacker signed in to a customer support portal with valid credentials that were not protected by multi-factor authentication, then used a legitimate built-in export tool to download student and teacher tables as CSV files.

Every control that would have stopped it is unglamorous: MFA on a support portal, rate limiting on bulk exports, alerting on unusual export volume, and a retention policy that would have meant 1985 student records were not still sitting in a live system in 2024.

For anyone evaluating a vendor that holds data on their customers, the questions this incident raises are worth asking directly. Is MFA enforced on every administrative and support interface, including the ones your own staff never touch? What does the vendor's support organization have access to, and is that access logged and alerted? How far back does retained data go, and why? And if the vendor pays a ransom on your behalf, what exactly have you been told you are protected from?

The answer to the last one, as the districts extorted in May 2025 discovered, may be nothing.