After a recent PowerSchool data breach, affected school districts have confirmed that hackers accessed all historical student and teacher records, exposing decades of sensitive data. As reported earlier, PowerSchool first became aware of the breach in late December, publicly disclosing it on 8 January 2025.

Hackers infiltrated PowerSchool’s systems by exploiting stolen credentials to compromise the company’s customer support portal. This granted them access to names, addresses, Social Security numbers, medical information, and grade records, according to a company FAQ shared with clients.

While PowerSchool itself has not clarified the extent of the breach, a representative of one impacted school district told TechCrunch: “In our case, I just confirmed that they got all historical student and teacher data.”

A school official from another affected district said their logs revealed hackers accessed the data earlier than PowerSchool initially disclosed, accessing “demographic data for all teachers and students, both active and historical, as long as we’ve had PowerSchool.”

Additionally, Menlo Park City School District in California reported the breach included information on all current students and staff, as well as data dating back to the 2009-2010 school year.

Criticism has mounted over PowerSchool’s security protocols. Some school districts reported that the compromised system lacked basic protections such as multi-factor authentication (MFA). Although PowerSchool spokesperson Beth Keebler stated that the company “does use MFA,” she did not elaborate on its implementation or where it may have been absent.

PowerSchool acknowledged the breach and confirmed it is working to identify individuals whose data may have been exposed. The company claimed that it has taken steps to prevent the stolen data from being published (including the payment of a ransom) and believes it has been deleted, though it did not provide evidence to support this claim.

As Mark Racine, CEO of RootED Solutions, pointed out, the breach could extend beyond PowerSchool’s 18,000 current customers to include former clients as well. This means the number of affected individuals may be significantly higher than initially estimated.

This worrying development further raises concerns regarding the safety of user data held by online services. For example, a report revealed that nearly 100% of US online retailers have suffered a data breach.