2026-09-17
PowerSchool's hack was the largest breach of children's data in US history. What should you do with your kid's school file?
In December 2024, a 19-year-old college student turned one stolen employee login to a customer-support portal into the personal records of more than 70 million people — an estimated 62.4 million students and 9.5 million teachers across 6,505 school districts in the US, Canada, and beyond. The company was PowerSchool, whose cloud student-information system is one of the most widely used in K-12 education, and outlets covering the incident have called it the largest breach of children's data in US history. Paying didn't make it go away: PowerSchool paid roughly $2.85 million in Bitcoin hoping to keep the data from spreading, and by May 2025 the same attacker was emailing individual school districts directly, attaching samples of the still-stolen data to prove he still had it. The hacker, Matthew Lane, pleaded guilty and was sentenced in October 2025 to four years in federal prison plus roughly $14 million in restitution — a sentence that closes his case without closing the exposure, and the civil litigation against PowerSchool itself is still open, consolidated into an ongoing multidistrict case. None of that puts anyone's child's data back in the box. What it does mean is that a lot of parents, this year, have ended up with an actual downloadable file of their kid's school record sitting on a laptop or in an inbox — some because they asked for one, some because their district sent one. This post is about what's actually in that file, and what's honest to do with it.
What was actually in it
According to PowerSchool's own incident notice and the reporting that followed, the exposed data ran wider than a typical login-and-password leak: full names, birth dates, home addresses, phone numbers, grades, disciplinary records, special-education classification and IEP status, and family income data tied to free-and-reduced-lunch eligibility — plus, by PowerSchool's own count, Social Security numbers for fewer than 25% of affected students, since not every district stores SSNs in the system at all. That mix is why this one keeps getting singled out from a typical corporate breach: it isn't "a password leaked," it's a specific child's health status, discipline history, and family financial hardship, tied to a full name and a date of birth, sitting in one file.
Why you might have a copy of your own kid's file right now
Independent of this breach, FERPA already gives parents the right to inspect and review their child's education record, and federal regulation requires the school to respond within 45 days of a request — the Department of Education's own guidance on this is explicit, and for special-education records specifically, IDEA adds the right to obtain copies at a reasonable cost. In practice, that request increasingly comes back the way most school records now live: as an export from a cloud student-information system — the same category of platform PowerSchool itself is. Since the breach, some districts have also proactively sent parents a personal notification packet describing exactly what of their child's data was exposed. Either way, the practical outcome lands the same place this site already covered for medical records under HIPAA: once a sensitive record reaches you, the file is genuinely yours to protect, and no one else is doing that job for you.
Handling the file itself
Treat the file like any other record with a Social Security number and a birth date in it, with one extra step specific to this case: the filename itself is usually a child's full name — "Emma_Martinez_IEP_2026.pdf" tells anyone who sees it in a folder or an email attachment list exactly whose sensitive record it is, encrypted or not. Rename it to something anonymous before encrypting. NearSeal's default format (AES-256-GCM, keyed via PBKDF2-SHA256 at 220 iterations) authenticates the filename it stores in its header so it can't be silently altered, but that header isn't secret — the name still travels in the clear. If you'd rather the encrypted file carry no filename at all, the opt-in age-encryption.org format available in the same tool has no filename field, at the cost of losing the original name on decrypt. Either way, this runs entirely in your browser; the file and the passphrase never leave your device.
What this changes, and what it honestly doesn't
Encrypting the copy on your own device stops the failure modes that are still ahead of you: a lost or stolen laptop, a shared family computer, a folder that quietly syncs to a cloud account with a reused password, an email attachment forwarded to the wrong person months later. It does nothing to the copy the attacker already has — that exposure already happened in December 2024, and no encryption tool, from NearSeal or anyone else, reaches backward into a breach that already occurred. If your child's Social Security number was among the fewer-than-25% that were exposed, the actual response to that lives outside this app entirely: the FTC has let parents and guardians place a free credit freeze on a child under 16 since 2019, specifically because child identity theft commonly goes undetected for a decade or more — kids don't apply for credit, so nobody notices until the fraud surfaces years later, often when the child turns 18 and applies for a first loan or lease. There's also no passphrase recovery in NearSeal, ever, the same as every other file it seals — write the passphrase down somewhere durable, because losing it means losing this copy for good, on top of whatever else you're already dealing with.
The honest summary
The breach itself was never something a file encryption tool was going to fix, and this post isn't pretending otherwise. What it can do is make sure the next copy of your kid's record — the one you requested, or the one the district sent, sitting on your own device right now — doesn't turn into its own separate exposure over something ordinary: a stolen laptop, a synced folder, a forwarded email. That's a real, narrow thing worth doing. It is not a substitute for freezing your child's credit if their Social Security number was actually in what was stolen.