Labaton Keller Sucharow serves as Interim Co-Lead Counsel in a multi-district litigation against PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively, PowerSchool), Bain Capital, L.P. (Bain) and Movate, Inc. (Movate) (all together, Defendants) arising from a massive data breach of PowerSchool’s Student Information System (SIS). The breach exposed the personally identifiable information (PII) of over 60 million PowerSchool users, including students, teachers, and parents.
PowerSchool provides cloud-based data management software for K-12 schools to manage the data of students and educators. To use PowerSchool, students, parents, and teachers are required to provide sensitive PII, which PowerSchool stores and maintains while holding out its software as a secure repository for such data. Bain, a private equity firm, acquired majority ownership in PowerSchool in June 2024. Plaintiffs allege that leading up to and immediately after the acquisition, Bain directed PowerSchool to offshore cybersecurity, engineering, and IT functions to third-party contractors with insufficient cybersecurity protocols, including Movate, a third-party vendor lacking even basic security protocols.
As a result of these lax standards, in December 2024, cybercriminals known as ShinyHunters breached PowerSchool’s SIS by exploiting compromised credentials belonging to a Movate employee. The stolen data included the most sensitive categories of PII, such as names, addresses, Social Security numbers, dates of birth, medical information, disability status, and individualized education programs. PowerSchool did not detect the breach until the cybercriminals themselves informed the company and demanded a ransom. PowerSchool paid the ransom, but the threat actors failed to delete the stolen data, subsequently extorting multiple school districts and forcing affected individuals to fear the imminent threat of identity theft, monitor their credit more closely than before, and address fraudulent spending on their accounts.
In January 2025, following the filing of over fifty class action lawsuits, the Judicial Panel on Multidistrict Litigation transferred and consolidated all related cases for coordinated pretrial proceedings before the Honorable Roger T. Benitez in the U.S. District Court for the Southern District of California. On June 17, 2025, the court appointed Labaton Keller Sucharow Interim Co-Lead Counsel representing Track One Individual User Class Action Plaintiffs (Track One Plaintiffs), which includes students, parents, teachers, and teachers’ unions.
On March 18, 2026, Track One Plaintiffs overcame Defendants PowerSchool and Bain’s motions to dismiss, allowing key claims to proceed. Specifically, the court sustained claims against PowerSchool for negligence, negligence per se, negligent training and supervision, breach of fiduciary duty, unjust enrichment, California’s Unfair Competition Law, the California Confidentiality of Medical Information Act, the California Consumer Privacy Act, deceit, and declaratory relief. Notably, the court—also upheld theories of negligence, negligence per se, California’s Unfair Competition Law, unjust enrichment, declaratory and injunctive relief, agency liability, direct liability, and aiding and abetting against Bain, permitting Plaintiffs to hold the private equity firm to account for its role in directing the reckless cybersecurity cost-cutting measures that led to the breach.
The case is In re PowerSchool Holdings, Inc. and PowerSchool Group, LLC Customer Security Breach Litigation, No. 3:25-md-03149-BEN-MSB (S.D. Cal.).
