Cybersecurity in education is taking another hit. Texas Attorney General Ken Paxtonannounced the filing of a lawsuit against PowerSchool ,one of the largest providers of software for K-12 schools in the U.S. The case concerns a massive data breach in December 2024 that exposed the personal information of 62 million students worldwide (including more than 880,000 Texas students).
What is PowerSchool?
PowerSchool is a leading provider of cloud solutions for school districts and educational institutions. It has more than 18,000 customers and supports over 60 million students globally. Its services include school management systems, parent-teacher communication platforms, and performance monitoring tools
See also: Bridgestone: Cyberattack affects production
Precisely because of its central position in the education ecosystem, the data breach had a huge impact.
The December cyberattack
On December 19, 2024, an attacker gained access to the PowerSource using stolen subcontractor credentials . Through this access, they stole:
- full names and addresses,
- telephone numbers,
- passwords,
- parents and contact details,
- social security numbers,
- even medical data of students and teachers.
On December 28, 2024, the attacker demanded a ransom of $2.85 million in Bitcoin to keep the data from being made public.
According to BleepingComputer, the threat actor claimed to have personal information of 62.4 million students and 9.5 million teachers from 6,505 school districts in the US, Canada, and other countries.
Texas' answer
Attorney General Ken Paxton stressed that PowerSchool failed to protect Texas families:
“ PowerSchool’s failures violate both the Texas Deceptive Trade Practices Act and the Identity Theft Enforcement and Protection Act by misleading customers about security practices and failing to take reasonable steps to protect sensitive information entrusted to Texas families and school districts ,” his office said
See also: NoisyBear hackers target the energy sector
Paxton emphasized that parents "never have to worry that the information they provide to enroll their children will be stolen."
Ransomware, blackmail and hackers
PowerSchool admitted to paying the ransom to the attacker and receiving video as “proof” that the data had been deleted. However, the story didn’t end there.
In May 2025, someone claiming to be a member of ShinyHunters began blackmailing individual school districts, demanding new ransoms in exchange for not revealing the data. Although the leader of ShinyHunters denied his involvement, blaming an associate impersonating the group, the threats created further disruption.
At the same time, it was revealed that PowerSchool had been breached again in August and September 2024, using the same credentials, according to CrowdStrike.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The 19-year-old behind the attack
The case took a new turn when 19-year-old Massachusetts college student Matthew D. Lane pleaded guilty to masterminding the cyberattack. According to authorities, Lane worked with other hackers to extort millions of dollars through blackmail.
The guilty plea reveals that the threat did not come from an organized international network, but from young perpetrators who exploited serious security vulnerabilities in a critical education platform.
The implications for PowerSchool
The Texas lawsuit could pave the way for further legal action by other states and school districts. The charges focus on two points:
- Misleading statements about the level of security offered by the company.
- Insufficient protection measures, which led to the leakage of extremely sensitive data.
At a time when educational platforms have become critical to the operation of schools, the trust of parents and teachers is being shaken.
See also: 1,100 Ollama AI servers exposed on the Internet
Wider extensions
The PowerSchool case has reignited the debate over data security in education. Schools now rely on cloud systems for nearly every aspect of their operations: enrollment, performance, parent communication. That means any breach has a direct impact on millions of families.
Additionally, student data is particularly valuable to criminals. It contains not only personal information but also social security numbers, medical information, and contact information, which can be used for identity theft and financial fraud.
Overall, the Texas lawsuit against PowerSchool is not just about one company but gets to the heart of the issue: how secure is our children's data in digital school?
The case of Matthew D. Lane shows how easily a group of young hackers can exploit vulnerabilities in critical infrastructure. For EdTech companies, the message is clear: security is not a luxury, but a requirement for survival.
Parents, teachers, and students will demand more transparency and stronger protections. And states, like Texas, now appear willing to pursue liability in court.
Source: www.bleepingcomputer.com
