Memphis-Shelby County Schools files federal lawsuit against PowerSchool over data breach

Memphis-Shelby County Schools has filed a federal lawsuit against PowerSchool Holdings Inc., accusing the software provider of negligence, breach of contract, and false advertising following a major cybersecurity incident that compromised sensitive student and staff information. The suit was filed in the U.S. District Court for the Southern District of California by Frantz Law Group.

The plaintiff, a Tennessee public school district serving more than 110,000 students across 222 schools, alleges that PowerSchool failed to protect confidential data entrusted to the company. PowerSchool, headquartered in Folsom, California, provides administrative software to K-12 institutions and maintains personal information for more than 60 million students, parents, and faculty worldwide.

In December 2024, hackers infiltrated PowerSchool’s systems and stole sensitive data, including names, addresses, Social Security numbers, and phone numbers belonging to students and teachers. According to the lawsuit, PowerSchool did not notify school districts of the breach until nearly two weeks after it occurred. The company has since acknowledged paying a ransom to the attackers, but concerns remain that stolen data may be circulating or sold on the dark web.

The suit further claims that PowerSchool did not implement basic cybersecurity protections that could have prevented the breach. Memphis-Shelby County Schools asserts that it paid over $21 million to PowerSchool over the past 12 years, relying on assurances that its data would be stored securely.

“PowerSchool failed to uphold its end of the bargain to safeguard and protect students’ personal information,” said William Shinoff, trial attorney with Frantz Law Group. “The education community reasonably relied on PowerSchool’s claims of privacy and security, but the software provider breached numerous contractual and legal duties it owed Memphis-Shelby schools and other districts across the country.”

The legal action seeks compensation for actual and compensable damages, including costs incurred in responding to the breach and mitigating harm to students and staff affected by the theft of their personal information. PowerSchool has not yet issued a public response to the lawsuit. Frantz Law Group, which has a history of handling large-scale class actions and mass tort cases, is representing multiple school districts in the case against PowerSchool.