Tennessee’s Memphis-Shelby County Schools is the latest to file a Federal lawsuit against edtech provider PowerSchool for alleged negligence tied to a massive data breach, joining more than 100 districts across the country in seeking accountability.
Filed in the U.S. District Court of Southern California, the lawsuit from Memphis-Shelby County Schools seeks monetary damages to cover the costs of responding to the breach and its long-term impact. The complaint accuses PowerSchool of negligence, breach of contract, and false advertising after hackers accessed sensitive student and staff data by infiltrating the company’s systems.
That breach, which occurred in December 2024, involved hackers gaining unauthorized access to PowerSchool’s Student Information System through its PowerSource customer support portal, a tool used by school district staff. PowerSchool – the largest cloud-based education software provider in the United States, serving more than 75 percent of students across North America – confirmed that it was forced to make a “very difficult decision” in the aftermath.
“In the days following our discovery of the December 2024 incident, we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve,” PowerSchool said in a statement. “As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”
Which, according to the lawsuit, they did not. The district’s complaint states it is “likely” that the personal information of students, parents, and staff “has or will soon be published and sold on the Dark Web.”
Memphis-Shelby County Schools also alleges that stolen information includes names, addresses, Social Security numbers, phone numbers, email addresses, medical records, grades, student IDs, bus stop locations, and even passwords.
While not the first lawsuit filed over the breach, Memphis-Shelby County Schools is one of the largest districts to take legal action. Roughly 50 class action lawsuits – brought on behalf of teachers, students, and parents – have also been filed since PowerSchool disclosed the breach five months ago.
All lawsuits, including the Memphis-Shelby case and the consolidated class actions, were scheduled for preliminary hearings on Wednesday.
