PowerSchool Faces Suit Over Breach of Student, Teacher Data (1)

PowerSchool Holdings Inc. is facing three federal lawsuits alleging the education software provider negligently failed to protect the personal information of students, parents, and teachers that was exposed in a December data breach.

Sheilah Buack-Shelton, Tyler Baker, and Kimberly Kinney alleged in separate complaints that PowerSchool breached its duties under common law, contract law, industry standards, and the Federal Trade Commission Act to implement reasonable and adequate data security measures and provide timely notice of the breach.

Information exposed in the incident includes names, addresses, Social Security numbers, contact information, medical and financial information, student grades and grade-point averages, bus-stop information, and employment information, according to complaints filed Jan. 8-9 in the US District Court for the Eastern District of California.

PowerSchool said in a statement, “While we are not commenting on active litigation, our team is focused on providing affected customers, families, and educators with the resources and support they may need as we work through this together.”

The company hasn’t disclosed the number of people affected by the breach. Buack-Shelton and Kinney allege that the breach exposed the data of millions of people. Baker alleges that the proposed class includes 827,000 people.

Victims have suffered lost time responding to the breach, out-of-pocket costs for mitigation measures, emotional distress, reduced value of their personal information, increased risk of fraud and identity theft, and payment for data-security that wasn’t provided, according to the complaints.

Each plaintiff seeks to represent a nationwide class of people whose information was exposed in the breach. Buach-Shelton also seeks to represent a California sub-class of affected people.

The complaints bring a variety of claims, including negligence, negligence per se, breach of fiduciary duty, breach of confidence, invasion of privacy/intrusion upon seclusion, breach of implied contract, unjust enrichment, declaratory judgment, and violations of the California Consumer Privacy Act.

The plaintiffs are variously seeking compensatory, statutory, exemplary, and punitive damages; statutory penalties; restitution; equitable and injunctive relief; attorneys’ fees and costs; and pre- and post-judgment interest.

MoginRubin LLP represents Buack-Shelton. Edelson Lechtzin LLP represents Baker. Zimmerman Reed LLP and Jennings & Earley PLLC represent Kinney.

The cases are Buack-Shelton v. PowerSchool Holdings Inc., E.D. Cal., No. 2:25-at-00037, complaint filed 1/8/25, Baker v. PowerSchool Holdings Inc., E.D. Cal., No. 2:25-at-00040, complaint filed 1/9/25, and Kinney v. PowerSchool Holdings Inc., E.D. Cal., No. 2:25-at-00042, complaint filed 1/9/25.