Wisconsin District Sues Ed Tech Giant PowerSchool After Massive Data Breach
The St. Croix Falls, Wisconsin, school district filed a federal lawsuit against education software behemoth PowerSchool Tuesday, kicking into motion a national campaign to hold the company accountable for what cybersecurity experts predict is among the largest student data breaches in history.
The lawsuit is one in a barrage of legal challenges that have emerged since the company announced in early 2025 it was the target of a December cyberattack that, according to the hacker, led to a global breach of some 62.4 million students' and 9.5 million educators' personal information. Though the company hasn't acknowledged how many people were affected, exposed sensitive files reportedly include Social Security numbers, special education records and detailed medical information.
Get stories like this delivered straight to your inbox. Sign up for The 74 Newsletter
Get stories like this delivered straight to your inbox. Sign up for The 74 Newsletter
The St. Croix Falls lawsuit alleges breach of contract, unjust enrichment and false advertising, which sets it apart from other class action lawsuits charging negligence against the education technology company whose cloud-based student information system dominates the K-12 market.
'At the end of the day, we believe that there were fraudulent misrepresentations made to the clients to induce them to go and be in these contracts with PowerSchool,' attorney William Shinoff, whose firm represents the St. Croix Falls district, told The 74 in an interview.
A Powerschool spokesperson didn't immediately respond to a request for comment Tuesday about the St. Croix Falls lawsuit.
Students and parents nationwide have filed more than 30 federal class action lawsuits against PowerSchool in connection to the December breach. The lawsuits, which could soon be consolidated, collectively allege PowerSchool was negligent when it failed to protect sensitive data and opened victims to potential identity theft.
But because these center on the data breach's potential for future harms, legal experts said, the cases could be dismissed almost as quickly as they were filed. The lawsuit filed by St. Croix Falls schools, meanwhile, alleges PowerSchool broke contractual obligations to keep data secure — and failed to provide schools the services they were promised.
'A cornerstone of the commercial relationship between' the school district and the company was educators' 'reliance on PowerSchool's representation that it would adequately protect' students' and educators' sensitive information, according to the complaint filed in federal district court in Sacramento. Instead, PowerSchool 'has done little to help' the school district and people whose information was compromised.
Courts nationwide could soon be flooded with similar complaints. Shinoff said his firm, the Frantz Law Group, plans to 'file thousands' of them on behalf of school districts across the country. The precise number of districts affected by the breach is unknown.
'What I can tell you is we've already spoken to hundreds of districts,' Shinoff said. 'Our hope is that they will all get involved in this to ensure that PowerSchool is held accountable, that they can ensure that this information moving forward is indeed protected, and to make sure they're reimbursed these public dollars that were spent for their programs.'
Shinoff represents large groups of school districts in several recent high-profile lawsuits, including against Facebook's and Instagram's parent company Meta and the electronic cigarette company Juul. The lawsuits alleging that the social media giant Meta exacerbated the youth mental health crisis involve nearly 1,000 districts, according to the firm.
Related
PowerSchool has acknowledged the hacker used a compromised password belonging to 'an authorized support engineer' to breach PowerSource, its customer support portal for school staff seeking help with its software tools. The PowerSource portal reportedly lacked multi-factor authentication, according to a draft cybersecurity audit and other records obtained by NBC News.
The full audit, released by the company last week, found its systems were breached in August — months earlier than previously disclosed — but couldn't say for certain it was by the same threat actors.
The company 'failed to implement the bare minimum security measures that are commonly utilized by similarly situated companies,' the complaint alleges. 'Something as simple as providing for a multi-factor authentication log-in method would have been easily accomplished and would have prevented the Data Breach altogether.'
The legally binding data privacy agreement that the Wisconsin district is accusing PowerSchool of breaching requires that the company employ multi-factor authentication and data encryption, standard industry security measures. Its reported failure to do so also made PowerSchool one of only a handful of companies to be removed from the Student Privacy Pledge, a self-regulatory effort designed to ensure education technology vendors are ethical stewards of the sensitive information they collect about children. The company was kicked off Feb 13.
Related
In an earlier statement to The 74, PowerSchool spokesperson Beth Keebler said the company 'has and will continue to implement [multi-factor authentication] across all internal systems as part of its robust and ongoing security protocols.'
'PowerSchool is accessed by tens of thousands of customers, posing challenges to MFA management,' the statement continued. 'However, following the incident, PowerSchool has implemented additional hardening efforts, including MFA for any PowerSchool employee and contractor access to customer data on PowerSource.'
Despite PowerSchool's promise to bolster security measures, its customer districts have lost confidence in the company, attorney Mark Williams, who is assisting school districts in filing suits against the company, told The 74.
But because its student information system plays such a significant role in day-to-day operations — and contains so much information about students — he said that switching to a competitor could become a logistical nightmare.
'Many school districts are between the devil and the deep blue sea,' Williams said. 'Many of them don't have confidence in PowerSchool to secure their data but they are very hesitant to change the vendor of their [student information system] because it is extraordinarily expensive and burdensome to do so.'
Finding a competitor might also prove challenging. While the company may not be a household name — save for a flood of recent press following the breach — its student information system is one of the largest ed tech services in the U.S. with teachers nationwide using it every day to track grades, attendance and other performance metrics.
The company claims its software is used to support the learning for 60 million students globally at more than 18,000 institutions, including 90 of America's 100 largest school districts.
PowerSchool was acquired in October 2024 by the Boston-based private equity firm Bain Capital for $5.6 billion. The company, which also owns the college- and career-readiness platform Naviance, has acquired multiple smaller ed tech ventures, such as Schoology and SchoolMessenger, in recent years, furthering its reach into the nation's K-12 classrooms.
Williams is the author of the data privacy agreement central to the Wisconsin district's claims against PowerSchool. Created by the Student Data Privacy Consortium, a collaborative effort between school districts and technology vendors to keep students' information secure, the agreement is used by school districts in more than half of states to ensure the tech companies they contract with — including PowerSchool — follow stringent security practices.
Among its provisions is a requirement for companies to notify school district customers within 72 hours of learning data was accessed or obtained by an unauthorized third-party like a hacker.
PowerSchool was reportedly unaware it had fallen victim to the December attack until the hacker came forward with a ransom demand, according to NBC's reporting. The company then paid the hacker an undisclosed sum to prevent the stolen records from being shared publicly, the outlet reported, and was given a video by the threat actor apparently deleting the stolen files in their possession.
Through the agreements, PowerSchool also vowed to 'abide by and maintain adequate data security measures, consistent with industry standards' for the storage of sensitive records.
Williams accused the company of breaching those requirements — laying the groundwork for a first-of-its-kind legal battle for the data privacy consortium.
'We just felt that at some point you have to police the process, at some point you have to draw a red line,' Williams told The 74. 'We've got to protect the contract because it protects schools and it protects kids. So that's not negotiable for us.'
Given the difficulty school districts face in migrating to different student information services, St. Croix Falls seeks a commitment from PowerSchool — and court-ordered accountability — to ensure the company follows stringent cybersecurity standards in the future, said Shinoff, its attorney.
'At this point their word, to us, can't be trusted,' Shinoff said. 'For them to have someone that they're reporting to for a period of time is something that's essential — especially when we're dealing with thousands and thousands of districts across the country.'
Prior to the data breach, PowerSchool positioned itself as a national leader in K-12 education data security — and its CEO appeared at a White House event in 2023 to boast of its efforts to keep students' personal information out of the hands of malicious actors.
As an early adopter of a voluntary federal pledge to design products with security at the forefront, CEO Hardeep Gulati spoke alongside then-First Lady Jill Biden at the first-ever White House summit on K-12 school cybersecurity, where PowerSchool and other technology companies highlighted the need to strengthen digital safeguards at schools nationwide.
Watch: PowerSchool CEO Hardeep Gulati speaks at the first-ever White House summit on K-12 cybersecurity in 2023.
During the event, the company said it would provide free webinars, training videos and other resources to help schools better secure their systems.
In the year prior to the summit, Gulati said, the company successfully fended off 1 billion cyberattacks on its servers while ensuring schools were kept safe through a 'relentless investment and focus on every element of security.'
Now, the company has found itself under scrutiny by the tech industry, lawmakers and other elected officials. In North Carolina, state Attorney General Jeff Jackson opened an investigation into the PowerSchool breach, which exposed the sensitive information of nearly 4 million people in his state, 'to determine if they broke any laws.'
The company is also facing bipartisan federal scrutiny. In a Feb. 21 letter, senators from New Hampshire, Indiana and Oklahoma blasted PowerSchool for maintaining inadequate cybersecurity measures and accused it of offering delayed notifications and insufficient information to affected individuals.
'School district leaders who we have spoken with raised serious concerns about delays in your company's response to the cybersecurity incident, including delayed notifications to impacted schools,' wrote Sens. Maggie Hassan, Jim Banks and James Lankford. Sufficient use of basic cybersecurity safeguards like multi-factor authentication, they wrote, could have prevented the breach.
PowerSchool says it will provide two years of identity protection services to students and educators affected by the breach and credit monitoring services to 'adult students and educators.' Keeber, the PowerSchool spokesperson, said in the statement the company has seen 'no evidence of fraud or further misuse of the information involved to date.'
But the senators wrote that PowerSchool 'has not clearly communicated a date by which impacted individuals will receive' the services.
'Your delayed and unclear communication is unacceptable,' the letter continued, 'especially given the sensitive nature of the personal data that was stolen.'
Even before the breach, PowerSchool has faced criticism for its data collection, use and security practices. In the last five years, it has been named as a defendant in numerous federal lawsuits related to its data collection and use practices, a review of federal court records shows.
They include complaints accusing the company of subjecting people to persistent and unsolicited robocalls and of failing to properly identify children experiencing homelessness.
One federal lawsuit brought by a Seattle mother and former middle school teacher accuses the company of selling student data collected through Naviance and other services to more than 100 third-party 'partners' with inadequate consent from students or their parents. That lawsuit, filed in May 2024 in San Francisco, also alleges the company has leveraged the data it collects on students to train an AI chatbot.
'The information PowerSchool takes from students is virtually unlimited,' the complaint alleges. 'It includes everything from education records and behavioral history to health data and information about a child's family circumstances. PowerSchool collects this highly sensitive information under the guise of educational support, but in fact collects it for its own commercial gain.'
In a motion to dismiss the lawsuit, PowerSchool's attorneys claimed Cherkin's complaint relied on 'broad, general social critiques condemning surveillance capitalism, cybercrimes and manipulative digital product design, in an apparent attempt to mask that they cannot make specific allegations of wrongdoing by PowerSchool.'
Related
Keebler, the company spokesperson, denied Cherkin's claims that it sells data or uses personal data to train its chatbots.
But Cherkin argues the vast amount of data PowerSchool collects and shares about millions of students have made it an attractive target for cybercriminals — and should have been a red flag all along. She compared Powerschool's business model to that of social media companies that are built to amass and monetize user data.
'I'm truly not at all shocked that this happened,' she said of the breach. 'The only way, really, to keep data safe is to not collect it and stockpile it in the first place.'
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
14 minutes ago
- Yahoo
Boosting Social Security: A Simple Way to Increase the Average Payment Up to $1,000
Delaying benefits past your full retirement age increases them by 2/3 of 1% monthly. Knowing your break-even age can help you decide if delaying benefits is right for you. Deciding when to claim Social Security requires a holistic view of your situation. The $23,760 Social Security bonus most retirees completely overlook › Your monthly Social Security benefit is based primarily on your career earnings and when you claim benefits. The first one is pretty straightforward: The more you earn over the years, the more you pay in Social Security payroll taxes (up to a certain amount), and the larger you can expect your monthly benefit to be. Increasing your earnings, however, is much easier said than done. On the other hand, you're likely to have more control over the timing of your claim, and waiting until after your full retirement age (FRA) to collect Social Security will increase your monthly benefit. It's a simple move that could increase the average retiree's monthly payment by $1,000 or more. Your FRA is the age at which you qualify for your full monthly benefit, or primary insurance amount (PIA). Think of your PIA as your base benefit, and from there, the Social Security Administration adjusts what you ultimately receive based on whether you claim before or after FRA. Delaying benefits past your FRA increases them by 2/3 of 1% monthly, or 8% annually, relative to your PIA. These delayed retirement credits will stack up until you reach age 70. But just as your benefit increases when claiming after FRA, it decreases if you claim before FRA. You can start collecting Social Security at 62, but doing so will reduce your monthly check by as much as 30%, again relative to your PIA. To see this dynamic in action, let's assume your PIA is $2,000 (the average monthly benefit for retired workers as of April was $1,997.97), and your FRA is 67. Claiming right at 62 would get you a benefit of $1,400. However, if you delay until 70, you'd be eligible to receive $2,480. So, for someone entitled to the average benefit as their PIA, waiting until 70 to claim is enough to get them more than $1,000 per month versus claiming at 62. For someone expecting a PIA of $3,000 instead of $2,000, the monthly difference between claiming at 70 ($3,720) versus 62 ($2,100) increases to $1,620. And you don't have to claim at only the the extreme ends of this timeline. With the same $3,000 PIA, claiming at 69 gets you $3,480 while and claiming at 63 gets you $2,250 -- a $1,230 difference. If you want to do your own calculations, you can check your estimated benefit at different ages with your online Social Security Administration account. Although a higher monthly benefit is attractive and delaying benefits until 70 is a simple enough strategy, in theory, it's not the right move for everyone. First and foremost, if you need Social Security to cover essential expenses, then claim as soon as necessary. Stability should be your top priority. Even if you have other income streams (retirement accounts, pension, etc.), delaying Social Security until 70 may not be the best route if you're in poor health. This is why I always recommend people look at their break-even age to help with their decision. Your break-even age is when the total lifetime benefits from claiming at one age equals those from claiming at another age. If we continue with our first example and are deciding between claiming at 62 and claiming at 70 for someone collecting the average retired worker benefit, the break-even age is around 80 years and 5 months: Monthly Benefit Total Received atAge 80 Total Received atAge 80 and 5 Months Total Received atAge 81 $1,400 (claim at 62) $302,400 $309,400 $319,200 $2,480 (claim at 70) $297,600 $309,760 $327,360 Calculations by author. In other words, for the decision to claim at age 62 versus age 70, this person only gets more in lifetime Social Security benefits if they live until at least 80-and-a-half years old. Even with an extra $1,080 per month when claiming at age 70, it takes time to make up for the years of missed benefits from waiting. Break-even age isn't the only factor to consider, but it's a helpful data, in addition to things like your health, savings, and retirement goals. If you're like most Americans, you're a few years (or more) behind on your retirement savings. But a handful of little-known could help ensure a boost in your retirement income. One easy trick could pay you as much as $23,760 more... each year! Once you learn how to maximize your Social Security benefits, we think you could retire confidently with the peace of mind we're all after. Join Stock Advisor to learn more about these Motley Fool has a disclosure policy. Boosting Social Security: A Simple Way to Increase the Average Payment Up to $1,000 was originally published by The Motley Fool Error in retrieving data Sign in to access your portfolio Error in retrieving data Error in retrieving data Error in retrieving data Error in retrieving data
Yahoo
16 minutes ago
- Yahoo
NY senior's Social Security still going to the nonprofit that ran her housing complex — even after it folded
In a shocking collapse of care and accountability, elderly and disabled residents at two Rochester housing complexes were given just 10 days to vacate after a support program they depended on shut down suddenly, leaving some without housing or access to their own Social Security checks. One of those affected is 80-year-old Georgia Johnson. She is packed and ready to move, but can't. The reason? A nonprofit still controls her money. 'How can they be so heartless to take people's money when they have to live?' Johnson told News10NBC. Thanks to Jeff Bezos, you can now become a landlord for as little as $100 — and no, you don't have to deal with tenants or fix freezers. Here's how I'm 49 years old and have nothing saved for retirement — what should I do? Don't panic. Here are 6 of the easiest ways you can catch up (and fast) Nervous about the stock market in 2025? Find out how you can access this $1B private real estate fund (with as little as $10) Family Service of Rochester, the nonprofit tasked with running the Enriched Housing Program at Hudson Ridge and Danforth Towers, managed residents' Social Security and disability benefits in exchange for providing support services and paying rent on their behalf. But according to the Rochester Housing Authority and as previously reported, the organization owes more than $400,000 in back rent. And the New York State Department of Health said the care provided by Family Service had become so poor that it posed health and safety risks to residents. 'Want to hear the shocker?' Johnson asked. 'They told me I was going to be in one room with a partner… That wasn't even a downsize — that was a no-size.' Johnson's daughter, Jannine Johnson, found an assisted living facility willing to take her mother, but there's a catch: Family Service of Rochester is still receiving Georgia's Social Security benefits and has failed to reimburse her for prior payments that she should have received directly. Despite a promise that her May check would be refunded, the money never showed. The family tried to cut ties with the nonprofit, visiting the Social Security office to change the representative payee, but due to a clerical error, the June 3 payment still went to Family Service. 'That money was supposed to be put in mommy's account,' Jannine said. Now they've been told to ask the nonprofit to cut a check. So far? No check. No refund. No move. Read more: Want an extra $1,300,000 when you retire? Dave Ramsey says — and that 'anyone' can do it 'This country is supposed to be land of the free and home of the brave,' Georgia Johnson said, 'but in other countries they take care of their elders.' News10NBC's Deanna Dewberry contacted the board chair of Family Service of Rochester. She claimed she was unaware of the situation but said they're now trying to resolve it. Family Service issued a statement saying it is "following instructions" from the Social Security Administration. The nonprofit says it can only release funds for rent if it receives an invoice from a new facility. They claim checks are written weekly. With $400,000 in unpaid rent and dozens of displaced and vulnerable residents, the situation caught the attention of law enforcement. Both the Monroe County District Attorney and the New York State Attorney General have confirmed they're actively investigating. It would not be the first time that a nonprofit is accused of misusing government funds. The U.S. Attorney's Office has not yet commented. This case exposes just how vulnerable seniors can be when someone else controls their money. Here are five takeaways to protect yourself: Know your rights: If someone else is handling your benefits, you can change or revoke that arrangement by contacting the Social Security Administration (SSA) directly. Advance Designation allows you to pre-select up to three individuals as potential payees, offering peace of mind and preparedness. Keep documentation: Always keep records of your benefits, how they're spent and who is the payee. In emergencies like this, paper trails are everything. Keep in mind that SSA requires representative payees to report any changes that may affect the beneficiary's benefit payments within 10 days after the month in which the change occurred. Emergency savings and housing plans: Seniors and caregivers should create 'what if' emergency savings and housing plans, especially when third-party agencies are involved in finances. Understand your legal rights: Review or revoke power of attorney (POA) if you feel unsafe and assign a new one with legal assistance. Know elder abuse laws: Financial abuse is a crime. Report suspected abuse to Adult Protective Services or local law enforcement. Use technology safely: Beware of phishing and scams and never share financial information over the phone or email unless you're certain the individual you're speaking with is an authorized representative of the agency. Secure your devices by keeping your phone, computer and passwords safe, especially if you do online banking. Rich, young Americans are ditching the stormy stock market — here are the alternative assets they're banking on instead How much cash do you plan to keep on hand after you retire? Here are 3 of the biggest reasons you'll need a substantial stash of savings in retirement Robert Kiyosaki warns of a 'Greater Depression' coming to the US — with millions of Americans going poor. But he says these 2 'easy-money' assets will bring in 'great wealth'. How to get in now Here are 5 'must have' items that Americans (almost) always overpay for — and very quickly regret. How many are hurting you? Like what you read? Join 200,000+ readers and get the best of Moneywise straight to your inbox every week. This article provides information only and should not be construed as advice. It is provided without warranty of any kind.
Newsweek
an hour ago
- Newsweek
States Could Stop SNAP Benefits If Republican Bill Becomes Reality
Based on facts, either observed and verified firsthand by the reporter, or reported and verified from knowledgeable sources. Newsweek AI is in beta. Translations may contain inaccuracies—please refer to the original content. States could stop offering SNAP benefits if the One Big Beautiful Bill Act becomes reality and they are shouldered with more of the cost of the food stamp program. "Shifting responsibility for funding SNAP onto states would upend state budgets," Darcy Milburn, the director of Social Security and health care policy at the Arc of the United States, told Newsweek. "SNAP is an optional program for states, so state governments may decide to address this fiscal challenge by reducing SNAP benefits, restricting eligibility, or even opting out of SNAP entirely," Why It Matters More than 40 million Americans rely on SNAP, which provides monthly benefits to for low- and no-income households to help pay for groceries. What To Know As it stands, states pay for half of the administrative costs of running the food assistance program, while the U.S. Department of Agriculture (USDA) pays the other half. The USDA also covers the entire cost of benefits. But this could soon change: under the Republican-led budget bill, which is currently being considered in the Senate, states could be made to pay for a portion of SNAP benefits in order to reduce federal spending. The House-approved version of the bill mandates that states will need to pay up to 25 percent of the cost of benefits, dependent on individual state payment error rates, starting in 2028. Those with higher error rates—more than 10 percent—would pay the most. If the funding cannot be found, it could lead to states ending their participation in the food stamp program. "Because SNAP is an optional program for states, these deep federal funding cuts may result in some states opting to end SNAP entirely if they are unable to come up with the state funds required to fill the hole left by deep federal cuts," the Center for Budget and Policy Priorities (CBPP) reported in May. Numerous states have warned that the cost of the program could be catastrophic for state budgets if the plans go ahead. Michigan Governor Gretchen Whitmer has warned the state could face footing a $900-million bill, while Rhode Island could end up paying $85 million to make up the gap. In late May, the Wisconsin Department of Health Services said the state would lose some $314 million in food assistance if President Donald Trump's bill comes to pass. So far, no state has said they plan to drop out of the program if the bill passes. Stock image of a woman shopping for groceries. Stock image of a woman shopping for groceries. GETTY "States are not in a position to absorb these substantial additional costs," the CBPP warned. "In fiscal year 2024, tax revenue fell in 40 states after adjusting for inflation, and many states are projecting budget shortfalls in the short and long term." According to a report by Politico, senators on the Agriculture Committee are seeking to reduce the percentage of benefits being paid for by states with the highest error payment rates to 15 percent, down from 25. What People Are Saying A USDA spokesperson told Newsweek: "As set by Congress in law, SNAP is at the request of the state agency. Regardless of this reconciliation exercise, states have the option whether to participate." Darcy Milburn, speaking to Newsweek: "During times of economic uncertainty, we need SNAP more than ever. Any cuts to SNAP funding would make it even harder for people with disabilities and their families to access the food they need to live healthy lives. We urge Congress to reject proposals for any cuts to SNAP, and to work on a bipartisan basis to strengthen and protect this critical program." Jennifer Greenfield, associate professor at University of Denver who specializes in the intersection of health and wealth disparities, previously told Newsweek: "The proposed federal 'savings' are not savings at all—it's a shift of the costs to our already cash-strapped states and families. The net result will be to increase hunger and financial instability among households with children, older adults, people with disabilities, and veterans—while also sending tens of thousands of people into unemployment." President Donald Trump has not commented directly on the SNAP provisions included in the bill, but has urged lawmakers to pass it. "It's time for our friends in the United States Senate to get to work, and send this Bill to my desk AS SOON AS POSSIBLE!" he wrote on Truth Social. What's Next The Senate is expected to revise several parts of the legislation before holding a final vote.
