PowerSchool Data Breach Settlement: No Payout Exists — The Case Is Still in Court

Who qualifies

• Nobody is eligible for a breach payment, because there is no fund to be eligible for. Anything currently offering to file a PowerSchool breach claim for you is not a legitimate settlement administrator — no such claim process exists.
• The people affected are broadly defined: current and former students, their parents and guardians, and school staff whose records were held in PowerSchool's Student Information System by districts that used the product. Prosecutors described the threatened data as including names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information and passwords.
• PowerSchool offered two years of credit monitoring and identity protection through Experian to students and faculty of its SIS customers, and said it did so regardless of whether an individual was specifically involved. That enrollment period concluded on July 31, 2025 and is no longer open.
• If a settlement is eventually reached in MDL 3149, a court-approved notice program would follow and a claim form would be published on a court-authorized website. That has not happened. Until it does, there is no deadline to miss.
• The one PowerSchool-related claim window that did exist has already closed: the separate Naviance settlement took claims until July 27, 2026, with a final approval hearing set for August 19, 2026. See our Naviance page for that case.

What actually happened, and where each strand of the case stands

1. 1

   December 2024 — the breach

   PowerSchool's own incident disclosure states that on December 28, 2024 it became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System environments through one of its community-focused customer support portals, PowerSource. The company says it experienced no operational disruption and continued serving customers normally, and that it has no evidence other PowerSchool products were affected. Notably, PowerSchool has never itself published a count of affected individuals — the widely circulated figures come from prosecutors and reporting, not from the company.

2. 2

   The ransom, and why it matters here

   PowerSchool paid. The company's May 7, 2025 statement says that in the days following discovery it "made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve," calling it a difficult decision not made lightly, and acknowledging the known risk that attackers may not delete stolen data despite assurances. That risk materialised: in May 2025 a threat actor contacted multiple school districts directly to extort them using data from the December incident. PowerSchool said samples matched the previously stolen data and that it was not a new breach.

3. 3

   October 2025 — the hacker is sentenced

   The Justice Department announced that Matthew D. Lane, 20, of Sterling, Massachusetts, then a student at Assumption University in Worcester, was sentenced by U.S. District Judge Margaret R. Guzman to four years in prison and three years of supervised release, with a $25,000 fine, restitution of $14,075,540.58 and forfeiture. Lane used stolen login credentials to reach the network of a software and cloud storage company serving school systems, and moved student and teacher data to a server he leased in Ukraine. The company and others were threatened that data on more than 60 million students and 10 million teachers would be leaked worldwide unless a ransom of roughly $2.85 million in Bitcoin was paid. The restitution is owed to victim companies — it is not a fund for families.

4. 4

   April 2025 — the civil cases are consolidated as MDL 3149

   The U.S. Judicial Panel on Multidistrict Litigation centralized the lawsuits. Its transfer order, filed April 7, 2025, records 32 actions pending in three districts plus 23 related actions in eight more — 55 cases in nine districts — and transfers them to the Southern District of California before the Honorable Roger T. Benitez, as In re: PowerSchool Holdings, Inc., and PowerSchool Group, LLC Customer Data Security Breach Litigation, MDL No. 3149. The Panel described the plaintiffs as students, students' guardians and school staff, and the claims as "virtually identical" for negligence, breach of contract and unjust enrichment.

5. 5

   Where the litigation stands now

   It is in pretrial proceedings, which is the slowest and least visible stage. Plaintiffs' co-counsel reported in spring 2026 that the court had denied the defendants' motions to dismiss, allowing core claims to proceed — including against Bain Capital on allegations it exercised operational control over PowerSchool's cybersecurity decisions. No class has been certified, no trial date has produced a judgment, and no settlement has been announced. New individual cases were still being filed against PowerSchool entities as recently as August 3, 2026, which is itself a signal that the matter is nowhere near resolved.

6. 6

   The settlement people are confusing this with

   A genuine $17.25 million PowerSchool settlement exists — Q.J. v. PowerSchool Holdings LLC, No. 1:23-cv-05689 in the Northern District of Illinois. It resolves claims that the Naviance platform intercepted confidential student communications using third-party analytics code, and it covers people who logged into Naviance as a student between August 18, 2021 and January 23, 2026. Its claim deadline was July 27, 2026 and its final approval hearing is August 19, 2026. It is a tracking-and-privacy case, not a hacking case, and filing in it has no bearing on the breach litigation.

7. 7

   What is actually worth doing

   Since there is no claim to file, the useful actions are protective rather than financial. A credit freeze is free at each of the three nationwide credit bureaus and can be placed for a minor as well as an adult, which matters here because children's Social Security numbers are the most valuable and least-monitored kind of stolen identity data. IdentityTheft.gov is the free federal service for reporting and recovering from identity theft if something does surface.

8. 8

   How to spot the scam version

   Breaches this large reliably attract fake claim sites within weeks. Because no PowerSchool breach settlement exists, any site promising you a payout, quoting a per-child amount, or charging a fee to file is fabricating it. When and if a settlement is reached, notice will come through a court-authorized administrator and filing will always be free.

Frequently asked questions

Sources and official records

Every figure and date on this page was taken from the primary records below — court dockets, agency releases, and the settlement administrator's own notices. Payout averages we describe as averages are calculated from the official totals, not reported per-person estimates.

• PowerSchool's own incident page — the December 28, 2024 discovery, exfiltration through the PowerSource support portal, the admitted ransom payment, the May 2025 re-extortion of districts, and the July 31, 2025 close of credit-monitoring enrollment
• U.S. Judicial Panel on Multidistrict Litigation — Transfer Order in MDL No. 3149, filed April 7, 2025: 55 cases from nine districts centralized before Judge Roger T. Benitez in the Southern District of California
• U.S. Department of Justice, District of Massachusetts — Matthew D. Lane sentenced October 14, 2025 to four years in prison with $14,075,540.58 restitution, and the ransom demand of about $2.85 million in Bitcoin
• CourtListener — the MDL 3149 docket, In Re PowerSchool Holdings, Inc., and PowerSchool Group, LLC Customer Data Security Breach Litigation, No. 3:25-md-03149 (S.D. Cal.)
• Hausfeld, plaintiffs' co-counsel — announcement that the court denied the motions to dismiss, including Bain Capital's, allowing negligence, unjust enrichment and California UCL claims to proceed (a party's own summary, not a court document)
• FTC consumer guidance — free credit freezes and fraud alerts, including for a child's credit file