Texas sues PowerSchool over massive data breach impacting students and teachers

Texas Attorney General Ken Paxton has filed a lawsuit against education technology company PowerSchool after a 2024 cyberattack exposed personal information belonging to millions of students and teachers nationwide, including nearly 900,000 in Texas.

The lawsuit, announced Wednesday, accuses the California-based provider of violating state consumer protection and identity theft laws by misleading schools about the strength of its cybersecurity safeguards and failing to protect sensitive data. Paxton’s office said PowerSchool overstated its security posture by promoting “state-of-the-art protections” while neglecting basic measures such as multifactor authentication.

The December 2024 breach affected about 6,500 of PowerSchool’s 18,000 school clients, according to state officials. The exposed data included names, addresses, Social Security numbers, disability records, special education information, and even bus stop locations, raising concerns about risks to children’s safety.

“If Big Tech thinks they can profit off managing children’s data while cutting corners on security, they are dead wrong,” Paxton said in a statement. “Parents should never have to worry that the information they provide to enroll their children in school could be stolen and misused.”

PowerSchool, which provides cloud services to K-12 districts across the country, disclosed the breach in a report to Texas regulators in May. The company has not publicly commented on the lawsuit.

Earlier this year, a Massachusetts college student pleaded guilty to carrying out the attack. The Texas lawsuit seeks accountability for what Paxton described as deceptive practices that placed millions of students and educators at risk.