Overview

• Attorney General Ken Paxton’s lawsuit seeks civil penalties, mandated security upgrades, and possible restitution for affected Texans.
• The December 19, 2024 intrusion used a subcontractor’s credentials to access PowerSchool’s systems and transfer unencrypted records to a foreign server.
• Exposed information included names, addresses, Social Security numbers, health and disability details, special education data, and school bus stop locations.
• PowerSchool serves more than 60 million students, and the attacker demanded $2.85 million in bitcoin; the company acknowledged making a payment to prevent disclosure, according to reporting.
• Despite that payment, school districts received extortion threats in May, and 19-year-old Matthew D. Lane later pleaded guilty to orchestrating the attack.