Texas sues PowerSchool for breach exposing the data of students and teachers

The state of Texas is suing education tech provider PowerSchool following a 2024 data breach that exposed sensitive information belonging to 62.4 million students and 9.5 million teachers.

Attorney General Ken Paxton alleges that PowerSchool violated state laws pertaining to deceptive trade practices and identity theft protection by deceiving customers about the strength of its security protocols and for its failure to protect users' data.

PowerSchool, based in California, provides cloud service for K-12 schools and says it is used by 18,000 school districts or individual schools. About 6,500 of those clients were impacted by the December 2024 hack.

The hacker accessed more than 880,000 Texas teachers’ and students’ data, Paxton said in a press release on Wednesday. PowerSchool filed a data breach report with Paxton’s office in May.

Paxton noted that PowerSchool markets itself as meeting “the highest security standards” and offering “state-of-the-art protections” for data. The company has acknowledged that it did not have multifactor authentication protocols in place before the breach. 

The breach exposed Texans’ names, addresses and Social Security numbers while also revealing disability records, special education data and even bus stops, which Paxton said could be used to locate specific children.

“If Big Tech thinks they can profit off managing children’s data while cutting corners on security, they are dead wrong,” Paxton said in a prepared statement. “Parents should never have to worry that the information they provide to enroll their children in school could be stolen and misused.”

A spokesperson for PowerSchool did not respond to a request for comment.

A Massachusetts college student pleaded guilty earlier this year to the hack.