JEFFERSON CITY — PowerSchool Holdings Inc., one of the world's largest school data software companies, is facing two class-action lawsuits following a data breach that allegedly exposed the personal information of over 60 million individuals.
The lawsuits, filed by plaintiffs K.I. and R.I. on behalf of all affected parties, and K.W. and J.I., on behalf of all others similarly situated, accuse PowerSchool of failing to adequately safeguard the personally identifiable information (PII) of its customers.
The complaints were filed Feb. 20 in U.S. District Court for the Western District of Missouri.
According to the complaints, PowerSchool discovered the breach on Dec. 28, 2024, when customer data from its PowerSchool Student Information System was stolen through the PowerSource support portal.
Hackers reportedly used an export data manager tool to access sensitive information, including Social Security numbers, passcodes, email addresses, mailing addresses, phone numbers, birthdates, medical records and school transcripts.
The plaintiffs argue that PowerSchool failed to implement reasonable security measures to protect customer data.
The lawsuits claim that had the company properly monitored its systems, the breach could have been prevented.
The plaintiffs also allege that the compromised PII is already being sold on the dark web, significantly increasing the risk of identity theft and other cybercrimes for those affected.
The complaint emphasizes the long-term consequences of the breach, highlighting the sensitive nature of the stolen information.
Unlike credit card data, which can be quickly changed or canceled, Social Security numbers and other PII are difficult, if not impossible, to alter.
Experts cited in the lawsuit warn that such data is particularly valuable on the black market, fetching prices far higher than financial information.
The plaintiffs seek compensation for a variety of damages, including the cost of credit monitoring and identity theft protection, reimbursement for losses stemming from fraud, and compensation for time spent mitigating the risks associated with the breach.
They also request injunctive relief to ensure PowerSchool implements and maintains robust data security measures in the future.
PowerSchool, headquartered in Folsom, Calif., provides database and data storage services to schools, students, parents and teachers worldwide.
The company collects and stores extensive personal information, making it a lucrative target for cybercriminals.
The plaintiffs argue that PowerSchool had a legal duty to protect this data and failed to meet established industry standards for cybersecurity.
The lawsuits reference other major data breaches to underscore the seriousness of the situation.
They cite incidents involving NationsBenefits, Point32Health and MCNA Insurance Company, which also suffered significant cyberattacks in recent years.
The complaints draw on guidance from the Federal Trade Commission (FTC) and the United States Cybersecurity and Infrastructure Security Agency, asserting that PowerSchool failed to follow best practices for data protection.
According to the filings, the breach stems from inadequate oversight and a failure to implement industry-standard safeguards.
The plaintiffs claim that PowerSchool only took action to enhance its security measures after the breach occurred, which they argue is inexcusable given the known risks.
The complaint also details the broader implications of the breach, including potential long-term harm to children and minors whose sensitive information is now exposed.
The lawsuit further contends that the data breach constitutes a violation of privacy rights and an unfair business practice under the FTC Act. It accuses PowerSchool of willful and reckless disregard for customer privacy, resulting in substantial harm to those affected.
The plaintiffs are represented by Maureen M. Brady of McShane & Brady in Kansas City.
Attorneys and PowerSchool did not respond to requests for comment.
U.S. District Court for the Western District Court case number: 4:25-cv-00120, 4:25-cv-00122