Unprecedented: Private Equity Firm Potentially on Hook for PowerSchool’s Data Breach

A threat actor gained unauthorized access to PowerSchool systems using stolen vendor credentials before Bain Capital's acquisition; data from thousands of K–12 school districts was exfiltrated and a ransom demand by the cybercriminal group ShinyHackers followed. Post-closing actions by Bain—offshoring cybersecurity/IT, enabling vendor bypass of consent protocols, and layoffs of critical IT staff—are alleged to have increased risk and led a California federal court to allow claims against Bain to proceed.