KVIG Informative

A federal judge ruled a private equity firm can be sued directly over a data breach at a company it bought, in a case that turns on the exact records schools keep on every child: grades, attendance, and enrollment.

Bain Capital closed a $5.6 billion acquisition of PowerSchool on October 1, 2024, taking over a company whose cloud-based student information software serves more than 75 percent of K-12 students in North America, according to PowerSchool’s own figures, spanning more than 18,000 school district customers and over 60 million students nationwide. Two months after the deal closed, the company disclosed that hackers had accessed its customer support portal and extracted data from its core system, the software districts use to manage grades, attendance, enrollment, and special education records.

What the Court Found A California federal judge allowed data breach claims to proceed directly against Bain Capital itself, not just against PowerSchool, marking what legal analysts describe as the first time a private equity firm has faced direct liability in court for a portfolio company’s cybersecurity failure. Court filings allege that after acquiring PowerSchool, Bain directed the company to offshore its cybersecurity, engineering, and IT functions to outside contractors, including at least a 5 percent workforce reduction that eliminated critical domestic IT staff, and that this offshoring required data-management tools that let vendors bypass consent protocols and access protected school district computers directly.

The court also found that Bain held contractual veto rights before the acquisition even closed over capital expenditures exceeding $5 million, material vendor contracts, and major workforce changes at PowerSchool, and that Bain replaced PowerSchool’s entire board immediately after closing. That level of pre-closing control is central to the legal theory allowing claims against Bain to proceed even for conduct that happened before the firm officially owned the company. U.S. Senators Maggie Hassan, Jim Banks, and James Lankford sent a joint letter to PowerSchool and Bain Capital executives demanding accountability, citing inadequate cybersecurity measures, delayed notifications to affected families, and poor communication from the company.

What This Doesn’t Mean for Every District Not every school district’s student data sits inside PowerSchool’s system. Clark County School District, Nevada’s largest, runs its student records through Infinite Campus, a separate company with no connection to this breach or to Bain Capital. That distinction matters beyond this single case: the company managing a district’s most sensitive student data, and who owns that company, is rarely something parents are told directly, and it can vary district to district even within the same state.

The breach exposed the personally identifiable information of more than 60 million PowerSchool users nationwide, according to litigation filed against the company, Bain, and the offshore contractor Movate, whose employee’s compromised credentials the hackers, a group calling itself ShinyHunters, used to gain access. That scale reflects how concentrated the K-12 software market has become: a single acquisition by a single private equity firm now sits between local school administrators and the records of tens of millions of children across the country.

The lawsuit against Bain is still working through the courts, but the underlying arrangement it exposed isn’t unique to PowerSchool. Behind nearly every piece of software a school district licenses, from grading platforms to bus routing to special education case management, sits a private company, and increasingly, that company sits inside a private equity portfolio. Whether a school board even knows who’s several ownership layers up from the vendor it signed a contract with is a question almost no district currently has a standard process for asking.