PowerSchool Begins Notifying Victims of Massive Data Breach

Education software giant PowerSchool has started notifying individuals across the U.S. and Canada whose personal data was compromised in a large-scale cyberattack that occurred in late December 2024. While the company has begun taking steps to address the breach, it has yet to disclose the full number of affected individuals.

The PowerSchool Cyberattack

PowerSchool, a cloud-based K-12 software provider, serves more than 60 million students and 18,000 educational institutions worldwide. It offers services related to enrollment, communication, attendance, staff management, learning, analytics, and financial operations.

The breach, which targeted PowerSchool’s customer support portal, PowerSource, exposed sensitive data from 6,505 school districts. According to the company, the compromised data varies by district but may include:

  • Full names
  • Physical addresses
  • Contact information
  • Social Security numbers (SSNs)
  • Medical data
  • Student grades

Although PowerSchool initially downplayed the extent of the breach, a threat actor claimed to have stolen data from over 62 million students and nearly 9.5 million teachers—suggesting the attack’s scope was much larger than the company admitted.

Notifying Affected Individuals

In an update published on its website, PowerSchool confirmed that it has started notifying impacted individuals, including current and former students, their parents or guardians, and educators in the U.S., Canada, and beyond.

“PowerSchool began the process of filing regulatory notifications with Attorneys General Offices across applicable U.S. jurisdictions on behalf of impacted customers who have not opted out of our offer to do so,” the company stated.

Identity Protection Measures

The breach has left many educators, students, and families vulnerable to identity theft and fraud. Depending on the school district, some individuals were notified that their SSNs and medical records had been stolen. However, it appears that Maine residents did not have their SSNs or medical data compromised.

To mitigate potential risks, PowerSchool is offering impacted students and educators a two-year free identity theft protection service, along with credit monitoring for affected adults.

Ongoing Concerns

Despite these efforts, questions remain about the transparency and scope of the breach. PowerSchool has not provided an official count of the total number of affected individuals, raising concerns among educators, parents, and regulatory bodies.

As investigations continue, cybersecurity experts urge those impacted to remain vigilant, monitor their financial accounts, and take advantage of the identity protection services offered.

Stay tuned for further updates as more details emerge about the extent of this massive data breach.

Email Notification to Fort Mill School District Parent

January 31, 2025
Dear PowerSchool User or Parent / Guardian of User:
You are receiving this notice on behalf of Student Name Removed (the “named individual”) from PowerSchool. As you may know, PowerSchool provides software and services to your current or former school or the current or former school of a person to whom you are a parent or guardian. In compliance with State laws, we are writing to share with you some important information regarding a recent cybersecurity incident involving personal information belonging to the named individual.
What Happened?
On December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized exfiltration of certain personal information from PowerSchool Student Information System (SIS) environments through one of our community-focused customer support portals, PowerSource.
What Information Was Involved?
Due to differences in customer requirements, the types of information involved in this incident included one or more of the following, which varied by person: name, contact information, date of birth, Social Security Number, limited medical alert information, and other related information. At this time, we do not have evidence that the named individual’s Social Security Number was involved. At this time, we do not have evidence that limited medical alert information for the named individual was involved.
What Are We Doing?
PowerSchool is offering two years of complimentary identity protection services to students and educators whose information was involved. For adult students and educators whose information was involved, this offer will also include two years of complimentary credit monitoring services.

If your personal information was involved in this incident and you are interested in enrolling in credit monitoring or identity protection, please follow the steps for either Option 1 or Option 2 below:

Option 1: If the Named Individual is 18 or Over
Enrollment Instructions
Ensure that you enroll by May 30, 2025 (Your code will not work after this date at 5:59 UTC)
Visit the Experian IdentityWorks website to enroll: https://www.experianidworks.com/plus
Provide your activation code: CTYU949PRK
For over the phone assistance with enrollment or questions about the product, please contact Experian’s customer care team at 833-918-9464
Be prepared to provide engagement number B138812
Details Regarding Your Experian Identityworks Credit Plus Membership
A credit card is not required for enrollment in Experian IdentityWorks. You can contact Experian immediately regarding any fraud issues, and have access to the following features once you enroll in Experian IdentityWorks:
Experian credit report at signup: See what information is associated with your credit file. Daily credit reports are available for online members only.*
Credit Monitoring: Actively monitors Experian file for indicators of fraud.
Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the Dark Web.
Identity Restoration: Identity Restoration agents are immediately available to help you address credit and non-credit related fraud.
Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.
$1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized electronic fund transfers.
Option 2: If the Named Individual is Under 18
Enrollment Instructions
Ensure that you enroll by May 30, 2025 (Your code will not work after this date at 5:59 UTC)
Visit the Experian IdentityWorks website to enroll: https://www.experianidworks.com/minorplus
Provide your activation code: CEBP456TRK
For over the phone assistance with enrollment or questions about the product, please contact Experian’s customer care team at 833-918-9464
Be prepared to provide engagement number B138813
Details Regarding Your Experian Identityworks Credit Plus Membership
A credit card is not required for enrollment in Experian IdentityWorks. You can contact Experian immediately regarding any fraud issues, and have access to the following features once you enroll in Experian IdentityWorks:
Social Security Number Trace: Monitoring to determine whether enrolled minors in your household have an Experian credit report. Alerts of all names, aliases and addresses that become associated with your minor’s Social Security Number (SSN) on the Experian credit report.
Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the Dark Web.
Identity Restoration: Identity Restoration agents are immediately available to help you address credit and non-credit related fraud.
Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.
$1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized electronic fund transfers.
As soon as PowerSchool learned of the incident, we engaged cybersecurity response protocols and mobilized senior leadership and third-party cybersecurity experts to conduct a forensic investigation of the scope of the incident and to monitor for signs of information misuse. We are not aware at this time of any identity theft attributable to this incident.
What Can You Do?
You are encouraged to remain vigilant against incidents of identity theft and fraud by reviewing account statements for suspicious activity. PowerSchool will never contact you by phone or email to request your personal or account information. The enclosed “General Information About Identity Theft Protection” provides further information about what steps you can take.
Other Important Information.
If you have any questions or concerns about this notice, please call 833-918-9464, Monday through Friday, 8:00am through 8:00pm Central Time (excluding major US holidays).
Sincerely,
The PowerSchool Team
* Offline members will be eligible to call for additional reports quarterly after enrolling.
** The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.
Si necesita ayuda en Español, por favor llame al 833-918-9464
Si vous avez besoin d’assistance en français, veuillez appeler le 833-918-9464
ذا كنت بحاجة للمساعدة باللغة العربية، فيُرجى الاتصال برقم 833-918-9464
Если вам необходимо получить помощь на Русский, пожалуйста звоните по телефону 833-918-9464
如果您需要简体中文协助,请拨打833-918-9464
በአማርኛ እርዳታ ከፈለጉ እባክዎን 833-918-9464 ይደውሉ
Nếu quý vị cần được trợ giúp bằng tiếng Việt, vui lòng gọi 833-918-9464
한국어 도움이 필요하시면 833-918-9464 으로 전화하시기 바랍니다.
اگر به زبان فارسی به کمک نیاز دارید، لطفاً با 833-918-9464 تماس بگیرید
GENERAL INFORMATION ABOUT IDENTITY THEFT PROTECTION
It is always advisable to regularly review statements from your accounts and periodically obtain your credit report from one or more of the national credit reporting companies. You may obtain a free copy of your credit report online at www.annualcreditreport.com by calling toll free 1.877.322.8228, or by mailing an Annual Credit Report Request Form (available at www.annualcreditreport.com) to: Annual Credit Report Request Service. P.O. Box 105281, Atlanta, GA, 30348-5281. You may also purchase a copy of your credit report by contacting one or more of the three national credit reporting agencies listed below:
Equifax, P.O. Box 740241, Atlanta, GA 30374-0241. 1.800.685.1111. www.equifax.com
Experian, P.O. Box 9532, Allen, TX 75013. 1.888.397.3742. www.experian.com
TransUnion, Consumer Disclosure Center, P.O. Box 1000, Chester, PA 19016. 1.800.888.4213. www.transunion.com
Fraud Alert: You may contact the fraud department of the three major credit bureaus to request that a “fraud alert” be placed on your file. A fraud alert notifies potential lenders to verify your identification before extending credit in your name.
Equifax:

 

Report Fraud:

 

1.888.378.4329
Experian:

 

Report Fraud:

 

1.888.397.3742
TransUnion:

 

Report Fraud:

 

1.800.680.7289
Security Freeze for Credit Reporting Agencies: You may request a security freeze on your credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing or other services. It is free to place, lift or remove a security freeze. You must separately place a security freeze on your credit report at each credit bureau. To do so, you must contact the credit bureaus by phone, mail, or secure electronic means:
Equifax: P.O. Box 105788, Atlanta, GA 30348, 1.888.298.0045, www.Equifax.com
Experian: P.O. Box 9554, Allen, TX 75013, 1.888.397.3742, www.Experian.com
TransUnion: P.O. Box 160, Woodlyn, PA 19094, 1.800.916.8800, www.TransUnion.com
To request a security freeze, you will need to provide the following:
Your full name (including middle initial, Jr., Sr., Roman numerals, etc.),
Social Security number
Date of birth
Address(es) where you have lived over the prior five years
Proof of current address such as a current utility bill
A photocopy of a government-issued ID card
If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft
If you request a freeze online or by phone, the agency must place the freeze within one business day. The credit bureaus have three business days after receiving a request by mail to place a security freeze on your credit report, and they must also send confirmation to you within five business days and provide you with a unique personal identification number (PIN) or password, or both that can be used by you to authorize the removal or lifting of the security freeze. To lift the freeze to allow a specific entity or individual access to your credit report, you must contact the credit reporting agencies and include (1) proper identification; (2) the PIN number or password provided to you when you placed the security freeze; and (3) the identities of those entities or individuals you would like to receive your credit report or the specific period of time you want the credit report available.

You also have rights under the federal Fair Credit Reporting Act (FCRA). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit http://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf or http://www.ftc.gov.

Steps You Can Take if You Are a Victim of Identity Theft
File a police report. Get a copy of the report to submit to your creditors and others that may require proof of a crime.
Contact the U.S. Federal Trade Commission (FTC). The FTC provides useful information to identity theft victims and maintains a database of identity theft cases for use by law enforcement agencies. File a report with the FTC by calling the FTC’s Identity Theft Hotline: 1-877-IDTHEFT (438-4338); online at http://www.ftc.gov/idtheft; or by mail at Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Ave., N.W., Washington, D.C. 20580.
Keep a record of your contacts. Start a file with copies of your credit reports, the police reports, any correspondence, and copies of disputed bills. It is helpful to log conversations with creditors, law enforcement officials, and other relevant parties.
Additional Steps to Avoid Identity Theft: The FTC has further information about steps to take to avoid identity theft at: http://www.ftc.gov/idtheft; calling 1-877-IDTHEFT (438-4338); or write to Consumer Response Center, Federal Trade Commission, 600 Pennsylvania Ave., N.W., Washington, D.C. 20580.
State Specific Information

District of Columbia residents can obtain information from the District of Columbia’s Attorney General’s Office regarding steps to take to avoid identity theft. This office can be reached by visiting the website at https://oag.dc.gov/, calling (202) 727-3400, or visiting 400 6th Street NW Washington, D.C. 20001.

Iowa residents may contact law enforcement or the Iowa Attorney General’s Office to report suspected incidents of identity theft. This office can be reached by visiting the website at www.iowaattorneygeneral.gov, calling (515) 281-5164 or requesting more information from the Office of the Attorney General, Hoover State Office Building, 1305 E. Walnut Street, Des Moines, IA 50319.

Massachusetts residents are reminded that you have the right to obtain a police report and request a security freeze as described above. There is no charge to place a security freeze on your account; however, you may be required to provide the credit reporting agency with certain personal information (such as your name, Social Security Number, date of birth and address) and proper identification (such as a copy of a government-issued ID card and a bill or statement) prior to its honoring your request.

Maryland residents can learn more about preventing identity theft from the Maryland Office of the Attorney General, by visiting their web site at www.marylandattorneygeneral.gov, calling the Identity Theft Unit at 1.410.576.6491, or requesting more information at the Identity Theft Unit, 200 St. Paul Place, 16th Floor, Baltimore, MD 21202.

New Mexico residents are reminded that you have the right to obtain a police report and request a security freeze as described above and you have rights under the Fair Credit Reporting Act as described above.

New York residents can learn more about preventing identity theft from the North York Office of the Attorney General, by visiting their web site at https://ag.ny.gov/resources/individuals/credit-lending/identity-theft, calling 1.800.771.77755 or requesting more information from the New York Attorney General’s Office, 28 Liberty St, New York, NY 10005.

North Carolina residents can learn more about preventing identity theft from the North Carolina Office of the Attorney General, by visiting their web site at https://ncdoj.gov/protecting-consumers/identity-theft/, calling 1.877.566.7226 or requesting more information from the North Carolina Attorney General’s Office, 9001 Mail Service Center Raleigh, NC 27699-9001.

Oregon residents may obtain information about preventing identity theft from the Oregon Attorney General’s Office. This office can be reached by visiting the website at www.doj.state.or.us, calling (503) 378-4400 or requesting more information from the Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096.

Rhode Island residents are reminded that you have the right to obtain a police report and request a security freeze as described above. The consumer reporting agencies may require that you provide certain personal information (such as your name, Social Security Number, date of birth and address) and proper identification (such as a copy of a government-issued ID card and a bill or statement) prior to honoring your request. Residents can learn more by contacting the Rhode Island Office of the Attorney General by phone at 1.401.274.4400 or by mail at 150 South Main Street, Providence, Rhode Island 02903.

South Carolina residents may access educational resources and the availability of consumer assistance from the South Caroline Department of Consumer Affairs. This office can be reached by visiting the website at https://consumer.sc.gov/, calling (803) 734-4200, or visiting 293 Greystone Boulevard, Ste. 400 Columbia, SC 29210.

Vermont residents may learn helpful information about fighting identity theft, placing a security freeze, and obtaining a free copy of your credit report on the Vermont Attorney General’s website at http://www.atg.state.vt.us.

 

Sign up for our Sunday Spectator. Delivered to your inbox every Sunday, with all the news from the week.