PowerSchool hit with 2 class actions over recent data breach

PowerSchool class action lawsuits overview:

• Who: Plaintiffs Sheilah Buack-Shelton and Kimberly Kinney filed separate class action lawsuits against PowerSchool Holdings Inc.
• Why: Buack-Shelton and Kinney each claim PowerSchool failed to adequately safeguard the personally identifiable information (PII) of millions of students, parents and school faculty during a December 2024 data breach.
• Where: The PowerSchool class actions were filed in California federal court.

PowerSchool bears responsibility for a December data breach that compromised the personally identifiable information (PII) of millions of students, parents and school faculty worldwide, a pair of new class action lawsuits allege. 

Plaintiffs Kimberly Kinney and Sheilah Buack-Shelton’s class action lawsuits separately claim the cloud-based education company failed to maintain reasonable security safeguard and protocols to protect the PII of its users, leading to the PowerSchool data breach. 

Kinney and Buack-Shelton argue PowerSchool, among other things, failed to properly encrypt its users’ data, causing it to be exposed to unauthorized third parties and putting those affected by the data breach at risk. 

“Plaintiff’s and Class Members’ Private Information was compromised through disclosure to an unknown and unauthorized third party — an undoubtedly nefarious third party seeking to profit off this disclosure by defrauding Plaintiff and Class Members in the future,” one of the PowerSchool class actions says.

Kinney and Buack-Shelton want to represent a nationwide class of consumers whose PII was exfiltrated or stolen in the PowerSchool data breach. Buack-Shelton also wants to represent a California subclass. 

PowerSchool failed to alert data breach victims for ten days, class action claims

Kinney and Buack-Shelton claim PowerSchool failed to alert individuals affected by the data breach for ten days and “nearly” ten days, respectively. 

“Ten days after it claims to have discovered the Data Breach, Defendant finally began sending the Notice to persons whose Private Information Defendant confirmed was potentially compromised as a result of the Data Breach,” one of the PowerSchool class actions says. 

Kinney asserts claims of negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment and breach of fiduciary duty. 

Buack-Shelton, meanwhile, claims PowerSchool is guilty of negligence and in violation of the California Consumer Privacy Act.

The plaintiffs each demand a jury trial and broadly request declaratory and injunctive relief and an award of compensatory, exemplary, punitive and statutory damages for themselves and all class members. 

An individual filed a similar class action lawsuit against Columbia University in late 2023 over claims the school failed to protect the sensitive information of students and employees, leaving it vulnerable to a May 2023 data breach.

What do you think about the allegations in the PowerSchool data breach class action lawsuits? Let us know in the comments.

Kinney is represented by Caleb Marker and Brian C. Gudmundson of Zimmerman Reed LLP and Christopher D. Jennings and Tyler B. Ewigleben of Jennings & Earley PLLC. 

Buack-Shelton is represented by Timothy Z. LaComb and Daniel J. Mogin of MoginRubin LLP. 

The PowerSchool class actions are Buack-Shelton, et al. v. PowerSchool Holdings Inc., Case No. 2:25-at-00037 and Kinney v. PowerSchool Holdings Inc., Case No. 2:25-cv-00098, each in the U.S. District Court for the Eastern District of California and. 

Read About More Class Action Lawsuits & Class Action Settlements:

• Washington AG files lawsuit against T-Mobile over 2021 data breach
• H&R Block class action alleges negligence in data breach
• Visionworks data breach compromised info of about 40K customers, class action claims
• Norwex class action claims data breach exposed personal identifying info