PowerSchool Sued Over Data Breach
Software company PowerSchool was sued Friday in U.S. District Court for Eastern California over allegations that the company’s negligence led to a data breach that compromised the data of 60 million students, educators, administrators and others, law firm Bradley/Grombacher announced Tuesday in a news release.
Sign up for a free preview to unlock the rest of this article
"PowerSchool's failure not only allowed this breach, but could very well allow continued data breaches of those students, teachers and administrators," said the firm's attorney Kiley Grombacher. "PowerSchool behaved in a reckless manner as they were made aware of the potential issues with their system but ignored it time and again."
The breach occurred Dec. 28, when cybercriminals infiltrated the software company and accessed highly sensitive information going back almost 20 years, including names, social security numbers and addresses of students and educators, the complaint said. The lack of robust authentication and security measures of PowerSchool led to the information being stolen by the cybercriminals, the complaint alleged. PowerSchool also failed to notify the affected individuals of the breach, instead notifying the school systems, putting them in the position of communicating the security failure to the families, it said.
PowerSchool's educational platforms are also used in classrooms in Canada. In a statement Monday, Canadian Privacy Commissioner Philippe Dufresne said his office has contacted the company "to obtain more information about this breach and to provide them with information about breach response and reporting requirements under privacy legislation. This will allow us to convey our expectations to the company regarding their response to the breach and to determine next steps."
PowerSchool didn't immediately respond to a request for comment.