Class Actions
PowerSchool Student Data Breach Litigation: MDL 3149 Status
What the PowerSchool student data breach litigation shows: the December 2024 incident, MDL No. 3149 and what the court record leaves undecided.
On this page
Something in this article wrong, out of date, or missing its source? Send the editorial desk a note.
The PowerSchool student data breach litigation is centralized in MDL No. 3149 in the Southern District of California. The Judicial Panel on Multidistrict Litigation created the proceeding by a transfer order filed April 7, 2025, which states that the litigation then consisted of 32 actions in three districts plus 23 related actions in eight others. The Panel’s October 1, 2026 statistics report lists 76 actions pending of 89 filed and names Senior Judge Anthony J. Battaglia as the transferee judge. The documents reviewed for this article record no certified class, no approved settlement, no trial date and no ruling on liability.
What PowerSchool said happened
PowerSchool’s notice to individuals in the United States states that on December 28, 2024 the company became aware of a cybersecurity incident involving unauthorized exfiltration of certain personal information from PowerSchool Student Information System environments through PowerSource, one of its customer support portals.
The notice says the information taken varied by person and could include the individual’s name, contact information, date of birth, limited medical alert information, Social Security number and other related information. It describes the people affected as current or former students and teachers of schools that use or used PowerSchool SIS.
The company’s March 7, 2025 update adds that PowerSchool had no evidence that credit card or banking information was involved, that other PowerSchool products were affected, or that malware or continued unauthorized activity remained in its environment. It also states that districts and schools that did not use PowerSchool SIS were not affected.
The same update says the company offered two years of identity protection to students and educators whose information was involved, with credit monitoring for adult students and educators. The United States notice records that the enrollment period closed on July 31, 2025, and addresses individuals under 18 separately, which reflects that the affected population includes minors.
Extortion attempts and the company’s ransom statement
In an update dated May 7, 2025, PowerSchool said a threat actor had contacted multiple school district customers in an attempt to extort them using data from the December 2024 incident. The company said samples of the data matched data previously stolen, so it did not believe this was a new incident, and that it had reported the matter to law enforcement in the United States and Canada.
The update states that PowerSchool decided to pay a ransom after the incident, in the company’s words, “because we believed it to be in the best interest of our customers and the students and communities we serve.” The company acknowledged the risk that the actor would not delete the stolen data. Nothing in the court documents reviewed for this article makes a finding about the payment or its effect.
What the transfer order says about the claims
The Panel’s order describes the actions as sharing factual questions arising from a cybersecurity incident involving unauthorized access to PowerSchool’s SIS software, which schools use to store current and former students’ and staff members’ personal information. It says the plaintiffs are students, students’ guardians and school staff seeking certification of overlapping nationwide and statewide class actions, and that the actions bring virtually identical claims for negligence, breach of contract and unjust enrichment.
The Panel identified the discovery topics as how and when the breach occurred, the sufficiency of PowerSchool’s data security practices, and how and when PowerSchool notified breach victims. The order decides none of those questions.
It also records that related state court litigation is pending in San Diego Superior Court, and it gave coordination of state and federal proceedings as one reason for choosing the Southern District of California. Several actions on the Panel’s schedule are captioned with initials rather than full names, a common practice where minors are among the plaintiffs.
What is established vs. what is alleged
Established by the documents reviewed: that PowerSchool described a December 2024 incident involving unauthorized exfiltration from PowerSchool SIS environments through PowerSource; the categories of information the company said were involved; the identity protection offer and its July 31, 2025 enrollment deadline; the May 7, 2025 statement about extortion attempts and the ransom payment; the creation of MDL No. 3149 by the April 7, 2025 transfer order; and the counts and transferee judge in the Panel’s October 1, 2026 report.
Alleged, not decided: that PowerSchool’s data security practices were inadequate; that the company delayed notifying affected people; that its conduct was negligent or breached a contract; that it was unjustly enriched; and that class members suffered the losses the complaints describe. The transfer order repeats those claims to explain why centralization was appropriate. It does not adopt them.
Not recorded in the documents reviewed: an admission of liability by PowerSchool, a finding that the breach caused any person’s identity theft or financial loss, a certified class, an approved settlement, a trial date or a verdict.
Where the claims stand procedurally
MDL No. 3149 is a consolidated pretrial proceeding, not a class action in itself. The Panel transferred the listed cases to one judge for coordinated or consolidated pretrial proceedings. Individual lawsuits keep their identities, and the transferee court manages discovery, expert issues and pretrial motions for all of them. Our guide to how an MDL differs from a class action explains the distinction.
The April 7, 2025 order assigned the proceeding to Judge Roger T. Benitez. The Panel’s October 1, 2026 report names Senior Judge Anthony J. Battaglia. The documents reviewed do not include the order that changed the assignment, so this article does not state why it changed. The report’s docket summary listing gives the master docket as 3:25-md-3149.
The report is a statistical snapshot, not a ruling. It records 76 actions pending of 89 filed. That count can change as cases are transferred, dismissed or remanded. The documents reviewed contain no order certifying a class, approving a settlement or setting a trial.
Key dates
- December 28, 2024: PowerSchool becomes aware of the incident involving unauthorized exfiltration from PowerSchool SIS environments through PowerSource, according to its notice.
- March 7, 2025: PowerSchool publishes its summary update, including the categories of information involved and the identity protection offer.
- April 7, 2025: the Panel files the transfer order creating MDL No. 3149 and assigns it to the Southern District of California.
- May 7, 2025: PowerSchool states that a threat actor had contacted school district customers to extort them using data from the incident, and that the company had paid a ransom.
- July 31, 2025: the identity protection and credit monitoring enrollment period closes, per the United States notice.
- October 1, 2026: the Panel’s report lists 76 actions pending of 89 filed and names Senior Judge Anthony J. Battaglia.
What this does not establish
The existence of MDL No. 3149 does not mean a court has found that PowerSchool’s security was inadequate or that it broke a law. It does not establish that the company delayed notice. The complaints allege a delay, and the transfer order repeats the allegation without deciding it.
The company’s statements about the incident are the company’s account. They describe what PowerSchool said it found and what it said it did, and they are not judicial findings. The same is true of the May 7, 2025 statement about the ransom payment.
No settlement has been approved in MDL No. 3149, and the documents reviewed record none. A website advertising a PowerSchool payout should be treated cautiously. Our guide to verifying settlement notices describes how to check an official court record. Related coverage of other consolidated data breach proceedings includes the MOVEit litigation, the Change Healthcare litigation and the AT&T customer data breach litigation. The class action section collects the rest.
Frequently asked questions
What is MDL No. 3149?
It is the federal multidistrict proceeding for lawsuits about the PowerSchool SIS data breach that the company says it discovered in December 2024. The Panel created it by a transfer order filed April 7, 2025 and assigned the pretrial proceedings to the Southern District of California.
Who are the plaintiffs?
The transfer order describes them as students, students’ guardians and school staff seeking to represent overlapping nationwide and statewide classes of people affected by the breach.
Has there been a settlement in the PowerSchool data breach litigation?
The documents reviewed for this article record no settlement, no preliminary approval and no final approval in MDL No. 3149. They also record no trial date.
What information was involved?
PowerSchool’s notice says the information varied by person and could include name, contact information, date of birth, limited medical alert information, Social Security number and other related information. The company said it had no evidence that credit card or banking information was involved.
How many actions are in the MDL?
The Panel’s October 1, 2026 report lists 76 actions pending of 89 filed. That count can change as cases are transferred, dismissed or remanded.
Sources
- United States Judicial Panel on Multidistrict Litigation: “Transfer Order, In re: PowerSchool Holdings, Inc., and PowerSchool Group, LLC Customer Data Security Breach Litigation, MDL No. 3149 (filed April 7, 2025)” (link, accessed 2026-10-25)
- United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Distribution of Pending MDL Dockets by Actions Pending (October 1, 2026)” (link, accessed 2026-10-25)
- United States Judicial Panel on Multidistrict Litigation: “MDL Statistics Report: Docket Summary Listing by MDL Number (October 1, 2026)” (link, accessed 2026-10-25)
- United States Judicial Panel on Multidistrict Litigation: “Pending MDL Dockets” (link, accessed 2026-10-25)
- PowerSchool: “Notice of Data Breach For Individuals in the United States” (link, accessed 2026-10-25)
- PowerSchool: “PowerSchool Cybersecurity Incident” (link, accessed 2026-10-25)
Collective Claim publishes general legal information. This article is not legal advice and does not create an attorney–client relationship. Court records and agency actions change; verify current status with the court or agency before relying on it.