SIS Incident

PowerSchool Cybersecurity Incident

This site will be updated periodically as PowerSchool learns more information and takes additional steps in response to a recent security incident.

May 7, 2025

PowerSchool is aware that a threat actor has reached out to multiple school district customers in an attempt to extort them using data from the previously reported December 2024 incident. We do not believe this is a new incident, as samples of data match the data previously stolen in December. We have reported this matter to law enforcement both in the United States and in Canada, notified all PowerSchool SIS customers of the development, and are working closely with our customers to support them. We sincerely regret these developments – it pains us that our customers are being threatened and re-victimized by bad actors.

Any organization facing a ransomware or data extortion attack has a very difficult and considered decision to make during a cyber incident of this nature. In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve. It was a difficult decision, and one which our leadership team did not make lightly. But we thought it was the best option for preventing the data from being made public, and we felt it was our duty to take that action. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.

In order to best mitigate this risk, we have also offered and made widely available credit monitoring and identity protection services for a period of two years to students and faculty of our PowerSchool SIS customers, regardless of whether they were individually involved.

We encourage all those who were offered these services to take advantage of them:

For individuals who reside in the U.S., you can find more information on identity protection services and credit monitoring here: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/
For individuals who reside in Canada, you can find more information on identity protection services and credit monitoring here: https://www.powerschool.com/security/sis-incident/notice-of-canada-data-breach/
For individuals who reside elsewhere, you can find more information via your school on the Experian services available to you or your child.

We recognize how this incident has affected our customers and are here to help as we navigate the path ahead together.

As of July 31, 2025, the monitoring enrollment period has concluded.

March 7, 2025

Summary Update

To our customers and the communities we serve, we would like to extend our gratitude and deepest appreciation for your patience and understanding as we have worked diligently to navigate the cybersecurity incident. We would like to provide a final update on this incident, though this website and the resources mentioned will continue to be available in the coming months.

What Happened?

Steps We’re Taking in Response

As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. We have no evidence that other PowerSchool products were affected as a result of this incident, or that there is any malware or continued unauthorized activity in the PowerSchool environment. Districts and schools that do not utilize PowerSchool SIS were not affected.

What Information Was Involved?

Information related to current and former students and educators involved included one or more of the following, which varied by person: name, contact information, date of birth, limited medical alert information, Social Security Number (SSN)/Social Insurance Number (SIN), and other related information. We have no evidence that credit card or banking information was involved. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base.  

Notification to Individuals, Credit Monitoring, & Identity Protection

PowerSchool has notified relevant regulators on our customers’ behalf in applicable jurisdictions as well as students (or their parents/guardians) and educators in the U.S. and Canada. In these geographies, we have offered complimentary identity protection services including, if applicable, credit monitoring services, for involved students and educators, regardless of whether an individual’s Social Security Number/Social Insurance Number was exfiltrated. In countries outside of the U.S. and Canada where the provider provides such services, PowerSchool is offering two years of complimentary identity protection services for all students and educators whose information was involved, regardless of what information about an individual was exfiltrated.

CrowdStrike Incident Report

PowerSchool engaged CrowdStrike, an industry leading cybersecurity expert, as soon as we became aware of the incident. After a thorough investigation, CrowdStrike has submitted its final incident report which you can read here.

CrowdStrike did not identify any new or concerning findings beyond what we already shared; these findings include:

The Threat Actor accessed PowerSource, a community-focused customer support portal, using a single compromised credential.
The Threat Actor’s activities were limited to exfiltration of select PowerSchool SIS instances of Students and Teachers tables.
CrowdStrike’s Recon+ Intelligence service has not identified any evidence of this exfiltrated information available for sale or download.
CrowdStrike found no evidence of system-layer access or malware associated with this incident.
CrowdStrike found no other PowerSchool products were compromised.
While the PowerSource environment experienced unauthorized activity prior to December, PowerSchool believes that the data exfiltration occurred in late December.

Our Commitment Moving Forward

PowerSchool is committed to protecting the security and integrity of our applications and regularly reviews and enhances its security policies and practices, and we will continue to prioritize and invest significantly in our cybersecurity defenses. PowerSchool takes our responsibility to protect student, family and educator data privacy extremely seriously, and we are committed to taking further steps to strengthen the security of our systems.

FAQs

Who is PowerSchool?

PowerSchool provides cloud-based software to K-12 schools. This security incident affected some of the districts using the PowerSchool Student Information System product. We have no evidence that any other PowerSchool products were affected as a result of this incident.

Who is eligible for complimentary identity protection services and credit monitoring?

PowerSchool is offering complimentary identity protection services including, if applicable, credit monitoring services, for involved students and educators, regardless of whether an individual’s Social Security Number/Social Insurance Number was exfiltrated. In countries outside of the U.S. and Canada where the provider provides such services, PowerSchool is offering two years of complimentary identity protection services for all students and educators whose information was involved, regardless of what information about an individual was exfiltrated.

How do I sign up for identity protection services and credit monitoring services?

For individuals who reside in the U.S., you can find more information on identity protection services and credit monitoring here: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/

For individuals who reside in the Canada, you can find more information on identity protection services and credit monitoring here: https://www.powerschool.com/security/sis-incident/notice-of-canada-data-breach/

For individuals who reside outside the U.S. and Canada in a country where the provider provides identity protection services, your school or district will have access to information about such services.
As of July 31, 2025, the monitoring enrollment period has concluded.

If my information was involved, how will I be notified?  

PowerSchool is coordinating with Experian and TransUnion to provide notice on behalf of our customers (in the U.S. and Canada) to students (or their parents / guardians) and educators, as applicable, whose information was involved and for whom we had available contact information. If you reside outside of the U.S. and Canada, you may be notified by your school or district directly.

What if I don’t get an email?

If you reside in the U.S. and do not receive an email, you can find more information linked here: http://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/

If you reside in Canada and do not receive an email, you can find more information linked here: https://www.powerschool.com/security/sis-incident/notice-of-canada-data-breach/

Would PowerSchool reach out to me directly to request my personal information?

No, PowerSchool will never contact you by phone or email to request your personal or account information. You may receive an email from Experian on behalf of PowerSchool, which will provide information about enrolling in Experian or TransUnion services, as applicable.

Were other PowerSchool products affected?

We have no evidence that other PowerSchool products were affected as a result of this incident. Districts and schools that do not utilize PowerSchool SIS were not affected.

Why does the data involved vary by customer?

This is because the information stored in a customer’s SIS is dependent on customer choice or district policies and requirements.

Do we need to secure our own systems as a result of PowerSchool’s cybersecurity incident?

We do not believe there is an ongoing risk to our systems. We have no evidence of malware or continued unauthorized activity in the PowerSchool environment. PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers. 

Has PowerSchool distributed a press release related to this incident?

Yes. In accordance with applicable laws and regulations, PowerSchool has distributed a press release via Business Wire in the United States and Canada an effort to inform the majority of those whose information was involved as a result of the incident.

Notices of Data Breach

General Updates

January 27, 2025: PowerSchool Notifies Applicable Attorneys General Offices Regarding Cybersecurity Incident

PowerSchool Notifies Applicable Attorneys General Offices Regarding Cybersecurity Incident

As we have communicated previously, on December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments. Related to that incident, today, January 27, 2025, PowerSchool began the process of filing regulatory notifications with Attorneys General Offices across applicable U.S. jurisdictions on behalf of impacted customers who have not opted-out of our offer to do so. PowerSchool has also started the process of notifying Canadian regulators. We will provide a separate update to our international customers later this week.

Some U.S. customers may also have notification requirements with their state’s Department of Education where required. Since many customers have already notified and are in close contact with their state’s Department of Education, PowerSchool will defer to those customers on making these notifications.

We are providing this update for broad awareness, and no further action is required from our customers at this time. In the coming days, PowerSchool will begin to provide notification of the cybersecurity incident to current and former students (or their parents / guardians as applicable) and educators whose information was determined to be involved. Importantly, these notices will include instructions for involved individuals on how to enroll in the credit monitoring and identity protection services that are being offered by PowerSchool.

We will be in contact directly with customers again soon with more information. Thank you to our customers, and their broader communities, for their ongoing patience and partnership.

January 24, 2025: Status Update

Status Update

Thank you for your continued patience as we navigate this cybersecurity incident. As we reported last week, PowerSchool will be offering complimentary identity protection services as applicable for all students and educators whose information was involved, plus two years of credit monitoring for adults, regardless of whether an individual’s Social Security Number or Social Insurance Number was exfiltrated. As we move forward with the process of notifying students and educators whose information was involved, as well as regulators on our customer’s behalf, we will provide another update in the next few days.

In addition to regularly updating the various FAQs on this web page, we want to address a recurring question: what data was involved, and for how many schools and individuals? We cannot confirm precise numbers because our data review process is still ongoing. Further, it is difficult to make broad statements about what data was involved because the answer varies by individual customer and is dependent on customer choice or district policies and requirements. We continue to prioritize transparent and direct communication with our customers and our shared communities, and remain committed to providing accurate and transparent updates as more information becomes available. We want to again extend our gratitude to our customers and the students, families and educators we serve. We are dedicated to using this incident as an opportunity to grow stronger and build greater resilience as a company.

January 13, 2025: Update

What Happened

On December 28, 2024, we became aware of a potential cybersecurity incident involving unauthorized access to certain PowerSchool Student Information System (SIS) information through one of our community-focused customer portals, PowerSource.

PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers. We have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.

Steps We’re Taking in Response

As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. We are working to complete our investigation of the incident and are coordinating with districts and schools to provide more information and resources (including credit monitoring or identity protection services if applicable) as they become available.

Who Was Affected

On January 7, 2025, we proactively communicated this incident to the PowerSchool SIS customers affected by this incident, and we continue to support them through next steps. Districts and schools that do not utilize PowerSchool SIS were not affected. If you are a parent or guardian who wants to know if your school was involved, please reach out to your school directly.

Moving Forward

We take our responsibility to protect student, family, and educator data privacy extremely seriously, and we are committed to providing customers, families, and educators with resources and support as we work through this together.

We would like to extend a sincere note of gratitude to our customer, educator and family communities for their continued patience and cooperation. We apologize for any concern this incident may cause you and are working hard to provide you timely updates.

General FAQ

What happened?

On December 28, 2024, we became aware of a potential cybersecurity incident involving unauthorized access to certain PowerSchool SIS information through one of our community-focused customer portals, PowerSource. PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers. We have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.

When will PowerSchool provide next steps to schools, educators and families?

We are working to complete our investigation of the incident and are coordinating with districts and schools to provide more information and resources (including credit monitoring or identity protection services if applicable) as they become available.

What steps are you taking to prevent this from happening again?

PowerSchool is committed to protecting the security and integrity of our applications and regularly reviews and enhances it security policies and practices. We continue to prioritize and invest significantly in our cybersecurity defenses.

What is the timeline for providing notification information to schools, educators and families?

As PowerSchool is working to complete our investigation, we are also taking steps to set up a system – in coordination with our customers – to be able to provide supportive resources (including credit monitoring or identity protection services if applicable) for individuals whose data may have been involved. As we have more definitive information on our timeline, we will share that accordingly.

FAQ for Families

Who is PowerSchool?

Am I required to reach out to my school or take any steps as a parent or guardian at this time?

No. If you are a parent or guardian of a student under the age of 18 and your student’s information was exfiltrated from their district’s PowerSchool SIS, you may receive a notification email from PowerSchool. Additionally, we have posted on our website and distributed a media release informing individuals of the incident and resources we have offered.

Was any student or family data involved in this incident?

For involved current and former students, parents / guardians of students, and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Security Number (SSN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base. The majority of individuals did not have their medical alert information or Social Security Number involved.

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Is PowerSchool offering credit monitoring?

Would PowerSchool reach out to me directly to discuss this incident, including requesting my personal information?

PowerSchool is committed to keeping our community informed and will be providing further resources as they become available. However, please remain vigilant as PowerSchool will never contact you by phone or email to request your personal or account information.

FAQ for Educators

Was any educator data involved in this incident?

Across our customer base, we have determined that for a portion of individuals, some personally identifiable information (PII), such as social security numbers (SSN) and medical information, was involved. We are working with urgency to complete our investigation and identify the individuals whose data may have been involved.

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Is PowerSchool offering credit monitoring?

How many districts and schools were involved?

Because of our ongoing investigation, we are not sharing specifics around the number of districts and schools we believe were involved. We are in communication with those customers directly and are supporting them through next steps.

FAQ for Customers

Was data from my school district involved?

We have proactively contacted the SIS customers that we believe may have had data involved. If you are not a SIS customer, you were not affected.

Should we take any action to secure our own systems?

Were other PowerSchool products affected?

Other than PowerSchool SIS, we have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.

U.S. Updates

As of July 31, 2025, the monitoring enrollment period has concluded.

January 29, 2025: Identity and Credit Monitoring Update for United States Customers

Identity and Credit Monitoring Update for United States Customers

Since our last update, we have initiated the process of notifying involved individuals in the U.S. about the resources now available to them. As part of this process, we have posted a notice to our website and published a press release. Credit monitoring and identity protection services are now activated and available.

In the coming weeks, Experian (on behalf of PowerSchool) will also be distributing direct email notifications to involved individuals for whom we have sufficient contact information. This does not apply to customers who have opted out of this process. The email notice will include further information about the information of theirs involved and the resources PowerSchool is offering. Additionally, we have coordinated with Experian to set up a toll-free call center for families and educators in case they have questions about these offerings: 833-918-9464

For individuals located in Canada, we will be reaching out next week with further information on the resources made available to you.

To our customers and the families and educators that we serve, please know that we sincerely appreciate your continued patience throughout this process. We remain committed to supporting you.

General FAQ

What is the timeline for providing notification information to schools, educators and families?

PowerSchool initiated notifying our customers on January 7, as well as individuals on January 29 by posting a notice to our website, and publishing a press release. In the coming weeks, direct email notifications will go out to involved students and educators for whom we have sufficient contact information.

FAQ for Families

Why is Experian notifying me instead of PowerSchool?

PowerSchool has engaged Experian, a trusted credit reporting agency, to provide complimentary identity protection and credit monitoring services on behalf of PowerSchool and our customers who opted in to these services. Additionally, PowerSchool worked with Experian to set up a dedicated, toll-free call center to answer any questions regarding the incident that involved individuals may have.

How do I sign up for credit monitoring?

For details on how to sign up for the resources being offered and how to reach the dedicated call center, you will be receiving an e-mail notification directly from PowerSchool in the coming days, or you can visit their website to learn how to activate the offerings from Experian, linked here: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/

What if I don’t get an email?

Involved individuals may receive an email communication in the coming weeks. If you do not receive an email, you can find more information linked here: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/ This notification provides details about the support resources we are offering, including complimentary credit monitoring and identity protection services if you do not receive a direct email.

What information of mine was involved?

For involved students and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Security Number (SSN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base. Please note regardless of whether an individual’s Social Security Number was exfiltrated, we are offering two years of complimentary identity protection services for all current and former students, parents / guardians of students, and educators whose information was determined to be involved. We are also offering two years of complimentary credit monitoring services for all adult students, and educators whose information was determined to be involved.

FAQ for Educators

Why is Experian notifying me instead of PowerSchool?

How do I sign up for credit monitoring?

What if I don’t get an email?

Involved individuals may receive an email communication in the coming weeks. If you do not receive an email, you can find more information linked here: https://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/. This notification provides details about the support resources we are offering, including complimentary credit monitoring and identity protection services if you do not receive a direct email.

FAQ for Customers

How will students and educators be notified if their information was involved?

We have initiated the process of notifying involved individuals. In the coming weeks following Jan. 29, direct email notifications will go out, and in the meantime, we have distributed a media release and posted a notice to our website.

January 17, 2025: Updated Information for U.S. Families, Educators and Customers

Updated Information for U.S. Families, Educators and Customers

What Happened

On December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments through one of our community-focused customer support portals, PowerSource. PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers. We have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.

Identity Protection & Credit Monitoring Services

PowerSchool will be offering two years of complimentary identity protection services for all students and educators whose information was involved and will also be offering two years of complimentary credit monitoring services for all adult students and educators whose information was involved. We are doing this regardless of whether an individual’s Social Security Number was exfiltrated.
PowerSchool has engaged Experian, a trusted credit reporting agency, to provide these services. Starting in the next few weeks, PowerSchool will coordinate with Experian to provide notice on behalf of our customers to students (or their parents/guardians if the student is under 18) and educators whose information was exfiltrated from their PowerSchool SIS.

Student and Educator Data Involved

Who Was Affected

On January 7, 2025, we proactively communicated this incident to the PowerSchool SIS customers affected by this incident. On January 17, 2025, PowerSchool shared next steps with those same SIS customers. Districts and schools that do not utilize PowerSchool SIS were not affected.

Steps We Are Taking in Response & Moving Forward

As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. Since then, over the last few weeks, we have been focused on assessing the scope of data involved, making further enhancements to our cybersecurity defenses, and developing a plan to help you and our shared community. We take our responsibility to protect student, family, and educator data privacy extremely seriously, and we are committed to providing customers, families, and educators with resources and support as we work through this together.

General FAQ

What happened?

When will PowerSchool provide next steps to schools, educators and families?

What steps are you taking to prevent this from happening again?

What is the timeline for providing notification information to schools, educators and families?

FAQ for Families

Who is PowerSchool?

Am I required to reach out to my school or take any steps as a parent or guardian at this time?

Was any student or family data involved in this incident?

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Will I get identity protection or credit monitoring?

PowerSchool is offering complimentary identity protection and credit monitoring services to all students and educators whose information from your PowerSchool SIS was involved. This offer is being provided regardless of whether an individual’s Social Security number was exfiltrated.

Identity Protection: PowerSchool will be offering two years of complimentary identity protection services, which will be provided by Experian, for all students and educators whose information was involved.
Credit Monitoring: PowerSchool will also be offering two years of complimentary credit monitoring services, which will be provided by TransUnion, for all students and educators who have reached the age of majority whose information was involved.

Credit monitoring agencies do not offer credit monitoring services for individuals under the age of majority. If a parent / guardian enrolls an individual under the age of majority in the offered identity protection services, the individual, upon reaching the age of majority, will have the opportunity to enroll in credit monitoring services for the duration of the two-year coverage period.

Would PowerSchool reach out to me directly to request my personal information?

Why is Experian notifying me instead of PowerSchool?

How do I sign up for credit monitoring?

For details on how to sign up for the resources being offered and how to reach the dedicated call center, you will be receiving an e-mail notification directly from PowerSchool in the coming days, or you can visit their website to learn how to activate the offerings from Experian, linked here: http://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/

What if I don’t get an email?

Involved individuals may receive an email communication in the coming weeks. If you do not receive an email, you can find more information linked here: http://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/. This notification provides details about the support resources we are offering, including complimentary credit monitoring and identity protection services if you do not receive a direct email.

What information of mine was involved?

Please note regardless of whether an individual’s Social Security Number was exfiltrated, we are offering two years of complimentary identity protection services for all current and former students, parents / guardians of students, and educators whose information was determined to be involved. We are also offering two years of complimentary credit monitoring services for all adult students, and educators whose information was determined to be involved.

FAQ for Educators

Was any educator data involved in this incident?

For involved students and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Insurance Number (SIN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base. The notice received by each individual will include a description of the categories of personal information that were exfiltrated and the identity protection and credit monitoring services offered (as applicable).

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Is PowerSchool offering identity protection and credit monitoring services?

How many districts and schools were involved?

We are not sharing specifics around the number of districts and schools we believe were involved. We are in communication with those customers directly and are supporting them through next steps.

Why is Experian notifying me instead of PowerSchool?

How do I sign up for credit monitoring?

For details on how to sign up for the resources being offered and how to reach the dedicated call center, you will be receiving an e-mail notification directly from PowerSchool in the coming days, or you can visit their website to learn how to activate the offerings from Experian, linked here: http://www.powerschool.com/security/sis-incident/notice-of-united-states-data-breach/.

What if I don’t get an email?

FAQ for Customers

Was data from my school district involved?

We have proactively contacted the SIS customers that we believe were affected. If you are not a SIS customer, you were not affected.

Should we take any action to secure our own systems?

Were other PowerSchool products affected?

How will students and educators be notified if their information was involved?

Canada & International Updates

As of July 31, 2025, the monitoring enrollment period has concluded.

February 5, 2025: International Customer Update

International Customer Update

PowerSchool has continued the process of notifying customers outside of the United States and Canada whose SIS was determined to be involved in this incident. In countries where Experian offers such services, PowerSchool will be offering two years of complimentary identity protection services for all students and educators whose information was involved, regardless of what information about an individual was exfiltrated. Due to available or applicable offerings in certain countries, we are not able to offer identity protection and/or credit monitoring services to all students and educators outside of the United States and Canada.

Individuals whose information was involved who reside outside of the United States and Canada may be notified by their school or district directly. The types of information involved in this incident included one or more of the following, which varied by person: name, contact information, date of birth, limited medical alert information, and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base.

To our customers and the families and educators that we serve, please know that we sincerely appreciate your continued patience throughout this process. We remain committed to supporting you, and we sincerely regret any concern this incident may have caused.

February 3, 2025: Identity and Credit Monitoring Update for Canadian Customers

Identity and Credit Monitoring Update for Canadian Customers

Since our last update, we have initiated the process of notifying involved students and educators in Canada about the resources now available to them. As part of this process, we have posted a notice to our website and published a press release. Credit monitoring and identity protection services are now activated and available for students and educators whose information was determined to be involved.

For individuals located in Canada, we have engaged Experian and TransUnion, trusted credit reporting agencies, to provide complimentary identity protection and credit monitoring services on behalf of PowerSchool to involved students and educators.

In the coming weeks, Experian (on behalf of PowerSchool) will also be distributing direct email notifications to involved students (or the parents / guardians of students, as applicable) and educators for whom we have sufficient contact information. The email notice will include further information about the information of theirs involved and the resources we are offering. Additionally, we have coordinated with Experian to set up a toll-free call center for families and educators in case they have questions about these offerings: 833-918-9464, Monday through Friday, 8:00am through 8:00pm Central Time (excluding major US holidays).

To our customers and the families and educators that we serve, please know that we sincerely appreciate your continued patience throughout this process. We remain committed to supporting you.

General FAQ

What is the timeline for providing notification information to schools, educators and families?

FAQ for Families

When will I be able to access the identity protection or credit monitoring?

All the information regarding the activation of and access to these services will be included in the email sent to you by Experian. You may also visit our website linked here for information on how to activate these services.

Why is Experian notifying me instead of PowerSchool?

PowerSchool has engaged Experian to provide notification of complimentary identity protection and credit monitoring services (which in Canada are offered by Transunion, a trusted credit reporting agency) on behalf of PowerSchool and our customers. Additionally, PowerSchool worked with Experian to set up a dedicated, toll-free call center to answer any questions regarding the incident and the services provided to involved individuals.

How do I sign up for credit monitoring?

For details on how to sign up for the resources being offered and how to reach the dedicated call center, you will be receiving an e-mail notification directly from Experian in the coming weeks that includes information about how to sign-up for TransUnion. You may also visit our website linked here to learn how to activate the offerings from Experian and TransUnion.

What if I don’t get an email?

Involved students (or parents / guardians of students, as applicable) and educators may receive an email communication in the coming weeks. If you do not receive an email, you can find more information on our website linked here. This notification provides details about the support resources we are offering, including complimentary credit monitoring and identity protection services if you do not receive a direct email.

FAQ for Educators

Why is Experian notifying me instead of PowerSchool?

How do I sign up for credit monitoring?

What if I don’t get an email?

FAQ for Customers

How will students and educators be notified if their information was involved?

We have initiated the process of notifying involved individuals. In the weeks following Feb. 3, direct email notifications will go out to students (or parents / guardians of students, as applicable) and educators determined to have information involved, and in the meantime, we have distributed a media release and posted a notice to our website. We continue to work in coordination with our customers to reach individuals involved in this incident.

January 24, 2025: Updated Information for Canada Families, Educators and Customers

Updated Information for Canada Families, Educators and Customers

Status Update

What Happened

On December 28, 2024, PowerSchool became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments through one of our community-focused customer support portal, PowerSource. PowerSchool is not experiencing, nor does it expect to experience, any operational disruption and continues to provide services as normal to our customers. We have no evidence that other PowerSchool products were affected as a result of this incident or that there is any malware or continued unauthorized activity in the PowerSchool environment.

Identity Protection & Credit Monitoring Services

PowerSchool has engaged TransUnion and Experian, trusted credit reporting agencies, to offer two years of complimentary identity protection services, which will be provided by Experian, for all students and educators whose information from your PowerSchool SIS was involved. PowerSchool will also be offering two years of complimentary credit monitoring services, which will be provided by TransUnion for all students and educators who have reached the age of majority whose information was involved. This service is being provided by TransUnion because Experian does not offer credit monitoring in Canada.

Starting in the next few weeks, PowerSchool will coordinate with TransUnion and Experian, to provide notice on behalf of our customers to students, parents / guardians and educators, as applicable, whose information was involved, as well as a call center to answer questions from the community.

Student and Educator Data Involved

Who Was Affected

On January 7, 2025, we proactively communicated this incident to the PowerSchool SIS customers affected by this incident. From January 17-24, 2025, PowerSchool shared next steps with those same SIS customers. Districts and schools that do not utilize PowerSchool SIS were not affected.

Steps We Are Taking in Response & Moving Forward

As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. Since then, over the last few weeks, we have been focused on assessing the scope of data involved, making further enhancements to our cybersecurity defenses, and developing a plan to help you and our shared community. We take our responsibility to protect student, family, and educator data privacy extremely seriously, and we are committed to providing customers, families, and educators with resources and support as we work through this together.

General FAQ

What happened?

When will PowerSchool provide next steps to schools, educators and families?

What steps are you taking to prevent this from happening again?

What is the timeline for providing notification information to schools, educators and families?

FAQ for Families

Who is PowerSchool?

Am I required to reach out to my school or take any steps as a parent or guardian at this time?

No. If you are a parent or guardian of a student under the age of majority and your student’s information was exfiltrated from their district’s PowerSchool SIS, you may receive a notification email from PowerSchool. Additionally, we have posted on our website and distributed a media release informing individuals of the incident and resources we have offered.

Was any student or family data involved in this incident?

For involved current and former students, and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Insurance Number (SIN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base. The notice received by involved individuals for whom we have sufficient contact information includes a description of the categories of personal information that were exfiltrated and the identity protection and credit monitoring services offered (as applicable). All the information regarding the activation of and access to these services will be included in the email sent to you by Experian. You may also visit our website linked here for information on how to activate these services

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Will I get identity protection or credit monitoring?

Identity Protection: PowerSchool will be offering two years of complimentary identity protection services, which will be provided by Experian, for all students and educators whose information was involved.
Credit Monitoring: PowerSchool will also be offering two years of complimentary credit monitoring services, which will be provided by TransUnion, for all students and educators who have reached the age of majority whose information was involved.

Would PowerSchool reach out to me directly to request my personal information?

FAQ for Educators

Was any educator data involved in this incident?

For involved students and educators, the types of information exfiltrated in the incident may have included one or more of the following: the individual’s name, contact information, date of birth, limited medical alert information, Social Insurance Number (SIN), and other related information. Due to differences in customer requirements, the information exfiltrated for any given individual varied across our customer base. The notice received by each individual will include a description of the categories of personal information that were exfiltrated and the identity protection and credit monitoring services offered (as applicable).

Was credit card or banking information involved in this incident?

We have no evidence that credit card or banking information was involved.

Is PowerSchool offering identity protection and credit monitoring services?

PowerSchool has offered two years of complimentary identity protection services for all current and former students and educators whose information was determined to be involved and two years of complimentary credit monitoring services for all students and educators who have reached the age of majority and educators whose information was determined to be involved. Please visit our website [notice] for information on how to activate the services. We are doing this regardless of whether an individual’s Social Insurance Number was exfiltrated.

How many districts and schools were involved?

We are not sharing specifics around the number of districts and schools we believe were involved. We are in communication with those customers directly and are supporting them through next steps.

FAQ for Customers

Was data from my school district involved?

We have proactively contacted the SIS customers that we believe were affected. If you are not a SIS customer, you were not affected.

Should we take any action to secure our own systems?

Were other PowerSchool products affected?

How will students and educators be notified if their information was involved?

PowerSchool will publish the notice on its website, circulate the notice to local media, and send the notice to email addresses, where available, of involved individuals.

The notice received by each individual will include a description of the categories of personal information that were exfiltrated and the identity protection and credit monitoring services offered (as applicable). We will also provide you a link to the notification if you would like to share with your community. Experian will also provide a call center to answer questions from the community.