If you’ve been young lately, you might have taken some sort of “Digital Safety” class. It was probably mediocre. Perhaps you used Powerschool’s Schoology learning platform that lesson, your teacher very likely used Powerschool SIS to mark you present, and perhaps standardized tests that month were on Powerschool’s Performance Matters service.
On January 7th, “Customers” of Powerschool SIS (schools and districts) were notified of a security breach that exposed student, parent and teacher personal information. The extent depends on the district but could include first, middle, and last names, home address, medical alerts, email, phone and potentially social security numbers. The breach reportedly affects over 60 million students and almost 10 million teachers. Though I have a GED now, my data was almost certainly still in the Powerschool system during the breach. Schools are digitally breached with alarming frequency. There have been 1,619 known K-12 school data breaches in the US from 2016-2022 that hit individual schools or districts. From 2005-2024, including colleges, there were 3,713 breaches, exposing over 36 million records. Edtech companies Blackbaud and Illuminate Education also had breaches in 2020 and 2021, affecting over a million students combined. MOVEit, a file transfer service used mainly by government was breached in 2023, affecting over 95 million people, including students in almost 900 schools, mostly colleges.
Schools have digital issues besides data breaches. Before Powerschool was breached explicitly, a lawsuit was filed accusing Powerschool of selling student data with only the unclear, coerced consent of parents. Similar data-selling lawsuits have been filed against companies like Google, IXL Learning, Instructure (best known for their Canvas learning platform) and Edmodo. My middle school chromebooks were configured to share location with every single website, with no way for us to turn it off. This middle school also had everybody’s school emails in a spreadsheet shared with everybody in the school, which I divined names from and used to email my friends. My former school district had the admin password for certain Microsoft admin accounts shared with all students (and staff) on Onedrive. Students logging into school accounts on non-school devices may find restrictions and surveillance applying on those devices as well. Meanwhile, many districts (including, briefly, mine) block websites like thetrevorproject.org, a website that provides, among other resources, a suicide hotline for LGBTQ youth. Happy pride month, by the way. The Wikipedia sister site Wikimedia Commons was blocked in my district, and a few schools block Wikipedia entirely. Social media and anything resembling it (like Youtube and non-school email) are blocked nearly always, resulting in both annoyance and serious blockage of information. I’ve lost track of the amount of times I’ve clicked a link in an assignment and got a block screen.
I’d like to be crystal clear here. Technology should absolutely be in our schools and lives. Whenever I had to write an essay or otherwise do a lot of writing on paper, I wished, so badly, that I could be typing instead. My handwriting is slow, hard to read, and painful. My typing is a painless 80 words per minute on a bad day. Technology and the internet do have real practical benefits, hard as they can be to see with each data breach and each AI-powered surveillant censorship extension.
As for Powerschool, they’ve paid to have student data deleted. It wasn’t, and individual schools and districts are now also being extorted. One of the perpetrators is now in court, a college student aged 19. January 17th, Powerschool has a page on their site explaining a little more about the incident, alongside Powerschool AI, Behavioral Support and a myriad of pages advertising their great security. The page read: “If you are a parent or guardian of a student under the age of 18 and your student’s information was exfiltrated from their district’s PowerSchool SIS, you will receive a notification email from PowerSchool over the next few weeks.”
I was pinged about the breach the day the news broke on most websites, pinged on a prominent Chromebook unblocking Discord server, no less. Yet, I still wonder.
The schools and districts got a notification email, probably several.
The parents (of <18 students anyway) should get a notification email.
When will I receive a notification email?
When will we?
Powerschool vs Student Privacy © 2025 by underdevelopedprefrontalcortex is licensed under CC BY-SA 4.0.
We now have a Bluesky! Follow @youthrights to stay in the loop on blog posts, node activity & more.
