PowerSchool's breach generated 71.9 million victim notices, the largest single data compromise tracked across any industry in 2025, according to the Identity Theft Resource Center's 2025 Annual Data Breach Report. The underlying incident, discovered in late December 2024 and disclosed the following January, exposed the personal data of more than 62 million students and 9.5 million teachers, per TechCrunch's reporting, making it the largest breach of children's data in US history.
Below is how that single incident compares to education's broader breach numbers, what an education-sector breach costs in 2026, how K-12 and higher-ed exposure trends have diverged, and where the regulatory fallout stands.
How big was the PowerSchool breach, and who did it affect?
An unknown hacker used a single compromised credential to access PowerSchool's customer support portal, then the broader PowerSchool SIS system that schools use to manage grades, attendance, and enrollment records. Investigators later found the attacker had access as early as August 2024, months before the breach was discovered. TechCrunch reported the exposed data included names, addresses, dates of birth, Social Security numbers, and medical information for students and staff across the US and Canada.
Figure 1: The two groups exposed in PowerSchool's breach, by estimated headcount. Source: TechCrunch reporting on the PowerSchool Cybersecurity Incident, January to March 2025.
The 71.9 million victim-notice figure ITRC recorded reflects notification volume, which can differ from the headcount of unique people affected since a single person can generate more than one notice across different school districts and states. Either measure puts PowerSchool well ahead of any other single 2025 compromise ITRC tracked, and it is the reason 2025's overall US victim-notice total, while down sharply from 2024's mega-breach-driven figure, still concentrated so heavily in one incident.
How much does an education data breach cost?
The average education-sector breach cost $4.15 million in 2026, up 9% from the year before, according to IBM's Cost of a Data Breach Report 2026, published July 29, 2026. That places education in the middle of IBM's industry rankings, above the $3.8 million retail average and the $3.5 million public-sector average, but well below healthcare's $6.64 million and financial services' $6.29 million.
Figure 2: The compliance path a school or EdTech vendor follows after a student-data breach. Source: FERPA guidance and typical state breach-notification triggers, as summarized in FTC EdTech enforcement actions.
If your organization builds or sells software to schools, you can generate a privacy policy that documents what student data you collect, how long you retain it, and how you will notify districts and families if it is exposed, the disclosures the FTC checked first in its recent EdTech enforcement actions.
How has K-12 and higher-ed exposure shifted?
Attack volume against US education institutions held roughly flat in 2025, but where the damage landed shifted sharply toward higher education. US K-12 districts logged 96 confirmed ransomware attacks in 2025, essentially flat against 2024, while US higher-education institutions logged 34, according to Comparitech's tracking. Total confirmed records exposed across all US education institutions rose 27%, from 3.1 million in 2024 to 3.9 million in 2025.
Figure 3: US education records breached by segment, 2024 versus 2025. Source: Comparitech education ransomware tracking, cited by GovTech.
K-12 records breached actually fell sharply, from 1.1 million in 2024 to 175,000 in 2025, while higher-ed records breached nearly doubled, from 1.9 million to 3.7 million, driven by large incidents at institutions including the University of Phoenix, which alone accounted for roughly 3.5 million exposed records. Average ransom demands against education targets fell 33% over the same period, from $694,000 in 2024 to $464,000 in 2025.
Figure 4: Average education ransom demand, 2025 against the 2024 figure. Source: Comparitech education ransomware tracking, cited by GovTech.
Figure 5: Recent landmark education data incidents and their regulatory aftermath, 2024 to 2026. Source: TechCrunch, FTC, court filings.
What has the regulatory response looked like?
Two separate 2026 actions show how education-sector breaches are now playing out in court and before regulators. The FTC gave final approval on June 5, 2026 to a modified order against Illuminate Education, an EdTech vendor whose breach exposed 10.1 million students' records, including health-related data, after the company had been alerted to the underlying vulnerabilities by a third-party vendor almost two years before the breach occurred. The order requires Illuminate to build a documented data security program, delete data it does not reasonably need, and publish a data retention schedule, a stronger remedy than a payment alone.
Separately, PowerSchool agreed to pay $17.25 million to resolve a class action covering more than 10 million current and former users of its Naviance product, over allegations that the platform intercepted confidential student communications between August 2021 and January 2026. That settlement received final court approval on August 19, 2026, and is distinct from PowerSchool's main SIS breach, which remains the subject of other pending litigation.
The Bottom Line
Education's breach numbers tell two different stories depending on where you look. Attack counts against K-12 districts specifically have held roughly steady, and K-12 records exposed actually fell sharply in 2025. But the sector's overall exposure kept climbing, driven by a single EdTech vendor breach that generated more victim notices than any other 2025 compromise across any industry, plus a growing share of higher-education incidents. Any school district or EdTech vendor handling student records now faces both FERPA-linked notification obligations and the kind of security-program remedy the FTC imposed on Illuminate, not just a one-time fine.
Frequently Asked Questions
What was the largest education data breach? The PowerSchool breach, discovered in late December 2024 and disclosed in January 2025, generated 71.9 million victim notices, the single largest compromise the Identity Theft Resource Center recorded across every industry in 2025. TechCrunch reported the underlying exposure affected more than 62 million students and 9.5 million teachers.
How much does an education-sector data breach cost on average? $4.15 million in 2026, up 9% from the year before, according to IBM's Cost of a Data Breach Report 2026.
Did PowerSchool pay a settlement over its breach? PowerSchool agreed to pay $17.25 million to resolve a separate class action over its Naviance product allegedly intercepting confidential student communications, with final court approval on August 19, 2026. That case is distinct from the main SIS data breach, which involves other ongoing legal proceedings.
How many K-12 ransomware attacks happened in 2025? 96 confirmed ransomware attacks against US K-12 districts in 2025, according to Comparitech, even as total US records exposed across all education institutions climbed 27% to 3.9 million, driven largely by a shift toward higher-education targets.
This is one entry in a broader look at data breach trends: see Data Breach Statistics 2026: Key Facts and Global Figures for the full industry picture, Retail Data Breach Statistics 2026 for how education's cost profile compares, and FTC Finalizes Illuminate Order Over 10.1M Student Records for the full detail on that enforcement action. A dedicated government-sector breach post is planned for this cluster but not yet published on this site.
Where the Numbers Come From
- Identity Theft Resource Center. (2026). "2025 Annual Data Breach Report: Record Number of Data Compromises in 2025." Published January 29, 2026. PowerSchool listed as the year's largest single compromise, 71.9 million victim notices.
- TechCrunch. (2025). "What PowerSchool won't say about its data breach affecting millions of students." More than 62 million students and 9.5 million teachers affected.
- IBM Newsroom. (2026). "IBM Study: One in Four Malicious Breaches are AI-Enabled." Cost of a Data Breach Report 2026, published July 29, 2026.
- GovTech. (2025). "Cyber Attacks on Schools Plateaued in 2025, but More Records Exposed." K-12 and higher-ed attack and records-breached figures, citing Comparitech.
- Federal Trade Commission. (2026). "FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students' Personal Data." Final approval June 5, 2026, 10.1 million students affected.
- DataBreaches.net. (2026). "PowerSchool's $17.25 Million Settlement Exposes Years of Student Data Tracking." Final court approval August 19, 2026.
Note: All figures verified as of September 2026. The PowerSchool SIS breach and the $17.25 million Naviance settlement are related but legally distinct matters involving the same company; other litigation tied to the main SIS breach remained active at publication. This post's figures are refreshed at least twice a year to track new ITRC, IBM, and court-filing updates.
