INSIGHTS
PowerSchool: one support account and data on 62 million students
In January 2025 PowerSchool warned school districts of a data theft affecting tens of millions of students and teachers, which started from a support account. The analysis: supplier privileged access, ransom, notification, lawsuits and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, January 2025 · by cybercoverinsurance
In January 2025 PowerSchool, one of the main providers of management software for US schools, warned its school district customers of a data theft that had taken place at the end of December. The attacker claimed to have taken data on 62.4 million students and 9.5 million teachers from 6,505 districts. PowerSchool paid a ransom of 2.85 million dollars in bitcoin. In May 2025 some districts received new extortion demands using the same data.
PowerSchool is the textbook case of a breach at a supplier that holds data on behalf of thousands of customers. The customers were not breached, but they own the data and must handle the consequences. For cyber underwriters, the case touches three points: support access as the way in, a ransom that does not end the extortion, and old data that nobody had deleted.
What is known
Access. According to the CrowdStrike investigation published by PowerSchool, the attacker used compromised credentials of a support user to enter PowerSource, the customer support portal for all PowerSchool products. From there the attacker used the remote maintenance function to reach customers' student information system instances. The activity ran from 19 to 28 December 2024. Data was exfiltrated only from the students and teachers tables, between 19 and 23 December. No malware or access beyond the application layer was found (CrowdStrike for PowerSchool).
Earlier access. CrowdStrike also found activity with the same credentials between 16 August and 17 September 2024. It could not link it with certainty to the December attacker or confirm whether student data was touched (CrowdStrike for PowerSchool). After the incident, access to PowerSource requires VPN, single sign-on and multi-factor authentication.
Data and ransom. On 28 December 2024 the attacker demanded 2.85 million dollars in bitcoin. PowerSchool paid and received a video showing the alleged deletion of the data. The data included names, addresses, phone numbers, passwords, parent information, Social Security numbers and medical data. From early May 2025 individual districts received extortion demands from someone presenting as ShinyHunters. The State of Texas, with more than 880,000 residents affected, sued PowerSchool in September 2025 for deceptive security practices (BleepingComputer).
The trial. Matthew Lane, from Massachusetts, pleaded guilty in May 2025. In October 2025 he was sentenced to four years in prison and ordered to pay almost 14.1 million dollars in restitution. Prosecutors put PowerSchool's losses at more than 14 million dollars, with about 3 million in illicit proceeds not recovered (CyberScoop). Some of the exposed data was decades old (K-12 Dive).
What is not known. How the support credentials were obtained has not been made public. The report does not say whether the account had multi-factor authentication at the time of the incident.
Support access is privileged access
One support account opened thousands of customers. The remote maintenance function exists so the supplier can help customers. But a single support account was enough to enter the instances of thousands of districts. It is privileged access in every sense, even if business language calls it "support".
The control added afterwards shows what was missing before. After the incident PowerSchool introduced VPN, single sign-on and multi-factor authentication for PowerSource, and time-based access controls (K-12 Dive). For underwriters, the question should be put to the supplier before the claim: who in support can reach customer data, from where and with what controls.
The August access is a warning. The same credentials had been used months earlier. If anomalous access goes unnoticed in August, the December theft meets no obstacle. The time between the first intrusion and discovery weighs on the cost of the claim.
The ransom does not end the extortion
The payment bought a video, not safety. PowerSchool paid 2.85 million dollars and received a video of the deletion. Five months later districts received new demands with the same data. It is the same lesson as Change Healthcare: a ransom guarantees neither deletion nor the end of demands.
The extortion moves to the customers. The second wave hit the districts, not the supplier. For customers' policies it is a new claim, originating at a third party. Customers' extortion cover must respond to a threat based on data stolen elsewhere, a situation wordings do not always anticipate.
Court-ordered restitution is not a recovery. Lane was ordered to pay 14.1 million, but most of the proceeds were not found (CyberScoop). For PowerSchool's insurer, subrogation against the offender has minimal practical value.
Who pays for notification
Customers own the data. School districts entrust student and teacher data to PowerSchool, but remain the data owners. Duties towards families, and often towards authorities, fall on them. Even when the supplier handles communications, the district must check, answer parents and manage reputational risk.
The contract decides who pays. Notification, support and monitoring costs can fall on the supplier if the contract says so. If the contract is silent or has low caps, the cost stays with the customer and its policy. For a public body with limited resources, the difference is large.
Old data increases the loss without adding value. Some exposed data was decades old (K-12 Dive). Former students now adults, with Social Security numbers and medical data, are people to notify and potential claimants. Keeping data that is no longer needed increases exposure with no operational benefit.
Lawsuits and regulators
Texas has led the way. The Texas Attorney General's lawsuit challenges deceptive security practices, not just the breach (BleepingComputer). For the supplier, exposure is not only towards the individuals affected, but also towards state authorities, with demands for civil penalties.
Class actions have already arrived. PowerSchool faces several lawsuits for negligence and late notification (K-12 Dive). For underwriters of a software supplier holding data on millions of people, third-party liability is the line that dominates the claim.
What to bring to renewals
Impact for insurersHigh
A single supplier support account exposed data on tens of millions of people held on behalf of thousands of customers.
On the portfolio side, the PowerSchool case suggests mapping the vertical suppliers that hold data for whole sectors: school management systems, medical practice software, platforms for local authorities. A single incident at one of them produces notification and liability claims across hundreds or thousands of insureds, often small public bodies with minimal cover.