PowerSchool Mobile

Is PowerSchool safe?

The app is low-risk; the system behind it has the worst security record of any education platform in our list. PowerSchool Mobile shows parents and students grades, attendance, assignments and lunch balances, carries no ads and declares no tracking on Apple's label. But it is a window into PowerSchool's student information system, and in December 2024 an attacker copied records of 62.4 million students and 9.5 million teachers from it, according to US Justice Department figures reported by BleepingComputer. We score PowerSchool Mobile 55/100, well below ClassDojo (73) and Google Classroom (69).

For families the practical point is that you rarely choose PowerSchool. The school district does, and the app works only if the district uses the PowerSchool system.

What happened in the 2024 PowerSchool breach?

On 19 December 2024 an attacker logged in to PowerSource, PowerSchool's customer support portal, with the stolen username and password of a contractor who had administrator rights. From there a maintenance tool gave remote access to school districts' databases. The stolen records differed by district but included names, addresses, phone numbers, parent details, medical alerts and, for some, Social Security numbers. The Texas attorney general's complaint adds disability and special-education records and bus stops.

PowerSchool discovered the theft on 28 December, when it received a ransom demand of about $2.85 million in Bitcoin, and it paid. Paying did not end the threat: in 2025 the attackers sent new extortion demands to individual school districts. PowerSchool later disclosed that the same stolen credentials had been used to enter PowerSource in August and September 2024, though its investigators, CrowdStrike, could not tie those visits to the December attacker. A 19-year-old Massachusetts student, Matthew Lane, pleaded guilty and was sentenced in October 2025 to four years in prison and $14 million in restitution.

The 2026 breach at Instructure, maker of Canvas, reached more people by the hackers' own count, about 275 million, but took less sensitive fields: names, emails, student ID numbers, course enrolments and messages, with no Social Security numbers or health information.

Why regulators blamed PowerSchool's security

Alberta's privacy commissioner published a 65-page report on 17 November 2025, alongside a parallel report from Ontario's commissioner. Alberta concluded that PowerSchool failed the industry standard of multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for PowerSource, that its password policy allowed short passwords (the stolen one had 10 characters), and that its controls on remote support access did not meet ISO 27001 or NIST standards. PowerSchool disputed some findings, saying maintenance access was on by default only for the first 30 days of a new installation.

These reports were addressed to school boards, the legal holders of the data, and ended in recommendations, not orders or fines. We count them because they describe PowerSchool's own systems, but less heavily than a ruling against the company.

The heavier item is in the US. On 3 September 2025 Texas Attorney General Ken Paxton sued PowerSchool under the state's Deceptive Trade Practices Act and its identity-theft law, on behalf of more than 880,000 Texan children and teachers. The suit says PowerSchool advertised "state-of-the-art protections" while lacking multi-factor authentication, proper access controls and encryption. These are allegations; we found no ruling or settlement by October 2026.

What the app itself collects

On its own, PowerSchool Mobile collects little. Apple's privacy label links only user content to your identity, and lists usage data, identifiers and diagnostics as collected without your name. Google Play lists crash logs shared for analytics, and device and user IDs collected for app functions.

PowerSchool's privacy statement, last updated on 1 October 2026, says it acts on the school's instructions, never sells customer data, does not use student data for ads, and trains its own AI models on de-identified data unless a school consents. Its marketing websites do use third-party advertising tools, but those are separate from the student system.

Control is the weak side. Google Play states that data can't be deleted on request, and PowerSchool forwards access and deletion requests to the district. If you want to know what is kept about your child, the district is the place to ask.

What PowerSchool has changed since

PowerSchool says on its security page that it now protects its product portals with multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and a VPN, and holds ISO 27001:2022 certification and SOC 2 Type 2 reports for several products. Its responses to Alberta also list the end of the "always on" maintenance access option. Those audits existed before the breach as well, which is why we weigh the incident more than the certificates. We found no public bug bounty programme for PowerSchool.

Schoology, PowerSchool's other school app

Many districts also use Schoology, PowerSchool's learning management system for assignments, course materials and class discussions, which has its own app. PowerSchool said the December 2024 breach involved only its student information system and that it had no evidence other products were affected, according to SecurityWeek. Schoology's App Store label is close to PowerSchool Mobile's: no tracking, user content and identifiers linked to you, and usage data and diagnostics collected without your name. It is rated 4+. Users are far less happy with it: on the US App Store it averages 1.35 stars from about 132,600 ratings, against 4.6 for PowerSchool Mobile. Google Play lists more than 10 million downloads.

How parents can protect a child after the breach

1. Ask your district whether your child's records were in the December 2024 breach, and which data fields were taken.
2. If a Social Security number was exposed, take the credit monitoring offered and consider a credit freeze for your child with the three US bureaus.
3. Treat any email, text or call that quotes your child's school details, medical notes or bus stop as a possible scam.
4. Use a unique password for your PowerSchool parent account, since sign-in is set up by each district.
5. Ask the district to switch off PowerSchool's remote maintenance access when it is not in use, as Alberta's commissioner recommended.

How we scored it

Scams and harmful content (74) is PowerSchool's highest factor, because the app is a closed school system without contact from strangers. Security (33) is the lowest: one stolen password without a second factor exposed tens of millions of children's records, and regulators found the safeguards below standard. The pending Texas suit sets the regulatory record at 60, and deletion that runs only through the school holds control at 52.