PowerSchool, a provider of software solutions for K-12 school systems, recently disclosed a cybersecurity incident that may have potentially exposed sensitive information of both students and school district employees. PowerSchool discovered on Dec. 28, 2024, that a threat actor was able to access their system and, in some instances, exfiltrate this sensitive information. The impacted sensitive information could include Social Security numbers, personally identifiable information, medical information, and grades. PowerSchool has stressed that not every customer was impacted and, even if a customer was impacted, not every impacted customer had sensitive information impacted. PowerSchool has indicated that they will provide specifics to specific customers if their data was impacted.
If you receive a notice from PowerSchool, Clark Hill’s Education Law and Cybersecurity, Data Protection & Privacy groups are ready to assist you. We have experience in analyzing legal obligations stemming from similar third-party cybersecurity incidents and assisting in crafting communications to both school employees and parents. If you receive a notice from PowerSchool or you have questions about these or other issues in connection with data breaches that may affect your schools, please contact a member of Clark Hill’s Education Law team.
This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.