Memphis School District Sues PowerSchool Over Data Breach

Anna Merod reports in Cybersecurity Dive on a major legal dispute between Tennessee’s Memphis-Shelby County Schools and educational technology provider PowerSchool over a data breach.

The school district filed a federal lawsuit in the U.S. District Court for the Southern District of California, accusing PowerSchool of negligence, breach of contract, and false advertising following a data breach that exposed sensitive information of students and staff (Memphis-Shelby County Schools v. PowerSchool Holdings, Inc.).

More than 100 school districts are pursuing legal action, citing PowerSchool’s failure to uphold contractual obligations.

The Memphis schools’ filing came one day before PowerSchool confirmed publicly that it was being extorted over stolen data linked to the December 2024 data breach, which affected multiple school districts across the country.

The article quotes plaintiffs’ attorney William Shinoff of the Frantz Law Group, who says that school districts depend on public funding, and the public expects the secure and reliable services they contracted for in return.

According to Shinoff, the districts are “really trying to seek reimbursement for taxpayer dollars that they overpaid, because PowerSchool didn’t meet their obligations under the contract.”

The Memphis-Shelby County Schools serve approximately 110,000 students. It has paid PowerSchool $21 million over the past 12 years for services. The complaint seeks financial damages to offset the cost of responding to the data breach and protecting affected individuals. 

The incident involved unauthorized access through PowerSchool’s PowerSource customer portal, which lacked multifactor authentication at the time of the incident.

Lawyers should take note of the increasing volume and complexity of litigation tied to ed tech data breaches and advise clients of the necessity for vendors to meet stringent cybersecurity standards and honor service contracts. The incident is likely to spur greater emphasis on negotiating robust data protection clauses in future tech contracts.