Hackers gained access to sensitive personal data of millions of students, parents, and teachers last month after breaching PowerSchool's systems, according to two lawsuits filed in California federal court. The educational software company is accused of inadequate security measures that left personal information exposed, including Social Security numbers, addresses, grades, and medical records.

Allegations of Negligence and Delayed Notification

Two proposed class actions—filed by Indiana teacher Kimberly Kinney and California resident Sheilah Buack-Shelton with her underage daughter—allege that PowerSchool Holdings Inc. failed to secure private information and delayed notifying victims of the breach. Hackers reportedly infiltrated PowerSchool's systems on Dec. 28, but affected individuals were not alerted until Jan. 7.

“PowerSchool failed to maintain reasonable security safeguards and protocols to protect its users’ personal identifiable information (PII),” Buack-Shelton alleged, noting that the compromised data appeared to be unencrypted.

Kinney echoed these concerns, accusing PowerSchool of breaching its responsibility to protect sensitive information. “Plaintiff and class members relied on defendant to keep their private information confidential and securely maintained,” Kinney said in her complaint.

Nationwide Impact of the Breach

PowerSchool serves school districts across the U.S., providing management, communication, and educational technology services. This role grants the company access to vast amounts of sensitive data, making its security failures particularly significant, according to the lawsuits.

Kinney’s suit seeks to represent a nationwide class of individuals whose PII was stolen, alleging negligence, invasion of privacy, breach of fiduciary duty, unjust enrichment, and breach of implied contract. Buack-Shelton’s complaint includes similar claims, adding violations of the California Consumer Privacy Act. Both lawsuits seek damages, injunctive relief, and coverage of legal costs.

PowerSchool’s Response

A PowerSchool spokesperson acknowledged the Dec. 28 cybersecurity incident, stating that the company immediately activated response protocols and involved third-party cybersecurity experts. The spokesperson claimed the breach caused no operational disruptions and emphasized the company’s commitment to protecting data privacy.

“We take our responsibility to protect student, family, and educator data privacy extremely seriously,” PowerSchool said. “We are committed to helping affected customers, families, and educators with resources and support.”

The lawsuits contend that PowerSchool failed to adequately address the breach and delayed its response, exacerbating the harm caused to individuals.

Legal Representation and Next Steps

Buack-Shelton and her daughter are represented by MoginRubin LLP, while Kinney is represented by Zimmerman Reed LLP and Jennings & Earley PLLC. Counsel for PowerSchool was not immediately available.

As the cases proceed, they could have far-reaching implications for data privacy standards in educational technology. The plaintiffs aim to hold PowerSchool accountable for alleged lapses in security and seek compensation for those affected by the breach.