Approximately 16,000 personal information records from three Seoul international schools (Korea International School, Seoul Foreign School, and Yongsan International School of Seoul) were compromised in a December 2024 cyberattack on PowerSchool. Compromised data included names, dates of birth, email addresses, home addresses, phone numbers, graduation years, and health-related information. PowerSchool reportedly paid hackers for a deletion promise, but extortion emails using the stolen data surfaced in May 2025. All three schools continue using PowerSchool despite the breach; Seoul authorities conducted limited oversight relying mainly on school self-assessments rather than independent security audits.
Spokane Public Schools reported a network security incident that compromised student and staff data, prompting the school district to take PowerSchool and BusinessPlus systems offline. Third-party cybersecurity specialists are investigating to identify affected individuals and specific compromised information. The incident's scope and root cause remain under investigation as of October 9, 2026.
Spokane Public Schools experienced a network security incident that took PowerSchool (grading and attendance system) and BusinessPlus (payroll system) offline starting Sunday evening, September 22, 2026. The district proactively shut down these critical systems in response to the threat and was working to restore services as of September 24, 2026.
PowerSchool confirmed a data breach affecting more than 175,000 former and current students and staff members in the Winston-Salem/Forsyth County Schools (WS/FCS) system. Stolen data includes social security numbers for thousands of staff members and other personally identifiable information.
PowerSchool disclosed a breach in January 2025 in which threat actors accessed its support platform using compromised credentials, potentially exposing records of students and staff across schools in the US and Canada. Exposed data included names, addresses, Social Security numbers, medical information, and grades affecting over 60 million students.
Newfoundland and Labrador's Office of the Information and Privacy Commissioner released Report P-2026-001 on May 11, 2026, examining the PowerSchool Student Information System cyber attack that exposed personal data of students, parents, and teachers across the province's K-12 system. The report finds that records dated back to 1995 for students and 2010 for teachers, and that 244,917 student MCP (medical care plan) numbers were among the data taken. Investigators concluded the core failure was PowerSchool not meeting its own contractual security commitments, compounded by insufficient oversight by the provincial Department of Education. The Commissioner issued recommendations to tighten contracts, improve monitoring of PowerSchool's compliance, directly notify a subset of current students whose Social Insurance Numbers may have been affected, and cease collection and retention of MCP numbers. The findings align with parallel investigations by privacy commissioners in Ontario, British Columbia, and Saskatchewan into the same PowerSchool breach.