TL;DR: In December 2024 attackers used a subcontractor's stolen login to break into PowerSchool, a school records platform, and downloaded databases holding data on 62.4 million students and 9.5 million teachers from 6,505 school districts. Exposed details included names, addresses, phone numbers, parent information, and for some people Social Security numbers and medical data. The attacker, Matthew Lane, was sentenced to four years in October 2025. Parents should consider a free credit freeze for their children.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

What happened

PowerSchool runs student information systems used by schools in the US, Canada and elsewhere. According to BleepingComputer, on 19 December 2024 the attackers used credentials stolen from a subcontractor to get into PowerSchool's PowerSource customer support portal, then used a maintenance tool to download school databases.

Those databases held information on 9.5 million teachers and 62.4 million students from 6,505 school districts. On 28 December the group demanded $2.85 million in Bitcoin. PowerSchool paid an undisclosed ransom, but the group went on to try to extort individual school districts as well.

What data was exposed

What was exposed varies by district, because each school chose what to store.

The sentencing

Matthew D. Lane, a 19-year-old student from Worcester, Massachusetts, pleaded guilty in May 2025 and was sentenced in October 2025 to four years in prison, plus $14 million in restitution and a $25,000 fine. The arrest doesn't undo the leak: copies of stolen data can keep circulating.

How to tell if your family was affected

Why children's data is a special risk

A child's Social Security number usually has no credit history, so fraud can go unnoticed for years until they apply for a student loan or first job. The FTC's child identity theft guide lists warning signs such as collection letters or IRS notices in your child's name.

What to do

  1. Freeze your child's credit. The FTC says parents can request a free freeze with Equifax, Experian and TransUnion for children under 16.
  2. Take any monitoring offered by the district or PowerSchool, but don't rely on it alone; see whether identity theft protection is worth it.
  3. Be wary of messages that mention the school. Breach data makes fake school, fee or exam messages convincing.
  4. Change reused passwords for parent portals.
  5. If you find fraud, report it at IdentityTheft.gov; our guide to reporting identity theft to the FTC walks through it. Watch for any class action settlement you may be able to claim.

Kids' data also leaks through what parents post. Our guide to sharenting covers that side. A free email exposure check checks your own email against known breaches.

Frequently Asked Questions

What happened in the PowerSchool data breach?

In December 2024 attackers used a subcontractor’s stolen credentials to access PowerSchool’s support portal and download school databases covering 62.4 million students and 9.5 million teachers.

What information was stolen from PowerSchool?

Names, addresses, phone numbers, parent information, contact details and passwords, plus Social Security numbers and medical data in some records. It varied by district.

Who was behind the PowerSchool hack?

Matthew D. Lane, a 19-year-old from Massachusetts, pleaded guilty and was sentenced in October 2025 to four years in prison.

How do I know if my child was affected?

Check for a notice from your school district or PowerSchool, and ask the district whether its data was involved and which fields were stored.

Should I freeze my child’s credit after the PowerSchool breach?

It is a sensible step if their Social Security number may be exposed. The FTC says freezes are free for children under 16.

Sources

Related Reading