PowerSchool Hack Exposed 15,666 Records at 3 Seoul International Schools, and All 3 Still Use It

Photo: KSH1015, Wikimedia Commons, CC BY-SA 3.0 (file photo, November 2023). The entrance road to Yongsan International School of Seoul, one of the three schools named in the data, as identified by the photographer.

The PowerSchool breach reached three of Seoul’s best-known international schools, exposing 15,666 personal records of students, parents and staff, according to Seoul education office data reported on Nov. 1 and 2. All three schools still run their student records on PowerSchool, the U.S. education-software company whose systems were hacked in December 2024 by a college student from Massachusetts.

The data were obtained by Seoul city council member Yun Yu-jin of the Democratic Party from the Seoul Metropolitan Office of Education and first reported by Maeil Business Newspaper. The Korea Herald followed with responses from the schools. The hack itself is not new. What is new is the school-by-school count and the criticism of how lightly the breach was followed up.

What was taken at each school

By school, 6,666 records were compromised at Seoul Foreign School, 8,000 at Korea International School and 1,000 at Yongsan International School of Seoul. The exposed information included names, dates of birth, email addresses, home addresses, phone numbers, students’ graduation years and health-related information, according to both newspapers.

The same education office data show about 27,000 personal-information records leaked from elementary, middle and high schools in Seoul between 2022 and September 2026. The three international schools account for about 60% of that total from a single incident.

Records per school: Seoul Metropolitan Office of Education data via Maeil Business Newspaper. Shares are Boston Report calculations.

Why the education office says its hands are tied

An education office official told Maeil Business that foreign schools cannot use NEIS, South Korea’s national education information system, which limits how far the country’s domestic privacy guidelines can be applied to them. The official said the office had reviewed the schools’ handling of personal data and sent letters urging caution.

Critics say that review fell short. The office did not ask the three schools to submit privacy self-assessment forms until January 2026, about a year after the attack, and those forms had staff mark their own compliance with an O or an X rather than undergo an independent audit, Maeil Business reported. Some foreign schools also skipped a February privacy training session for their data officers, though the three affected schools attended, according to The Korea Herald.

“It is difficult to say that just sending an official letter is enough,” Hwang Seok-jin, a professor at Dongguk University’s Graduate School of International Information Protection, told MK. Yun said that if schools have no choice but to keep using a company that suffered a breach, “education authorities must thoroughly verify whether the security vulnerabilities have been addressed,” according to The Korea Herald’s translation.

One school’s account

Korea International School told The Korea Herald it found the unauthorized access on Jan. 9, 2025, after reviewing system logs, reported it to education authorities and the Korea Internet and Security Agency, and notified students, parents and faculty the same day. Since then it signed a three-year contract with British data-security firm 9ine in April 2025 for annual security reviews and replaced its network firewalls in November 2025. The school said it had reviewed a final investigation report from PowerSchool and the cybersecurity firm CrowdStrike and had received no reports of secondary harm such as identity theft. Seoul Foreign School and Yongsan International School of Seoul had not responded to the newspaper’s questions as of its press time.

PowerSchool reportedly paid the hackers in exchange for a promise to delete the stolen data, both Korean newspapers said. Public schools in North Carolina and education authorities in Canada later received extortion emails using the data in May 2025.

The Massachusetts link

The cyberattack was prosecuted in Massachusetts. Matthew D. Lane, then 20, of Sterling, a former Assumption University student, was sentenced on Oct. 14, 2025, by U.S. District Judge Margaret R. Guzman to four years in prison, three years of supervised release, a $25,000 fine and $14,075,540.58 in restitution, the U.S. Attorney’s Office in Boston said.

According to the federal release, Lane used stolen login credentials between August and December 2024 to get into the network of “a software and cloud storage company that served school systems in the United States, Canada and elsewhere.” The company and others then received threats that data on “more than 60 million students and 10 million teachers” would be leaked unless a ransom of about $2.85 million in bitcoin was paid. The release does not name the company. Reuters and Maeil Business identify it as PowerSchool.

A wider pattern in Seoul

The education office has also kept doing business with Icecream Media, a Korean education-technology firm whose March breach exposed the records of about 200,000 elementary school teachers. Seoul education authorities signed 41,935 service and supply contracts with the company from March through September, Maeil Business reported. The cases add to a run of attacks on everyday systems that TBR has tracked across the Asia-Pacific and beyond, including hackers who pushed supermarket freezers to 50C across Europe.

Sources

• Maeil Business Newspaper: Three Seoul international schools kept operating after PowerSchool leak (Korean)
• MK (English): Seoul international schools and the PowerSchool breach
• The Korea Herald: Data on 16,000 people compromised at 3 Seoul international schools in PowerSchool breach
• U.S. Attorney’s Office, District of Massachusetts: Worcester college student sentenced to four years in prison for cyber extortions
• Reuters: Massachusetts man behind PowerSchool hacking gets 4 years in prison

Additional sources

• Lane was also sentenced over a separate 2024 attempt to extort a $200,000 ransom from a telecommunications company, according to the U.S. Attorney’s Office.
• Korea International School said PowerSchool confirmed it had put security patches and stronger account controls in place (The Korea Herald).
• The Korea Herald says seven of 16 foreign schools missed the February training; Maeil Business puts the figure at nine. The Boston Report has not independently resolved the difference.