Data on 16000 people compromised at 3 Seoul international schools in PowerSchool breach

Concerns grow over safeguards against future breaches as schools continue using PowerSchool; Seoul education office limits response to advisory notices

Almost 16,000 personal information records associated with international schools in Seoul were compromised in a December 2024 cyberattack on US-based education technology firm PowerSchool, local media reports said Monday.

The three schools affected continue to use PowerSchool's student information management system despite the data breach, raising questions over whether sufficient safeguards have been put in place to protect students, parents and faculty members.

According to a report by Maeil Business Newspaper, citing Seoul Metropolitan Office of Education data obtained by Seoul city council member Yun Yu-jin of the Democratic Party of Korea, 15,666 personal information records of students, parents and faculty were compromised across the three schools in 2025.

A total of 6,666 personal information records were compromised at Seoul Foreign School, while 1,000 were breached at Yongsan International School of Seoul. Another 8,000 were affected at Korea International School.

The compromised information included names, dates of birth, email addresses, addresses, phone numbers, students' graduation years and health-related information.

The incident stemmed from a cyberattack on PowerSchool in December 2024, during which hackers stole the personal information of tens of millions of students and teachers.

PowerSchool reportedly paid the hackers in exchange for a promise to delete the stolen data. However, concerns over further misuse of the information persisted after public schools in North Carolina and education authorities in Canada received extortion emails involving the stolen data in May 2025.

Limited oversight following data breach

Despite the breach, all three international schools reportedly continue to use PowerSchool's student information management system.

An official from the Seoul Metropolitan Office of Education told Maeil Business Newspaper that foreign schools in Korea cannot use the country's National Education Information System, making it difficult to uniformly apply domestic personal information protection guidelines.

The official said the education office had reviewed the schools' personal information management practices and sent notices urging them to exercise caution.

However, the reported inspections largely relied on self-assessments conducted by the schools themselves, rather than independent security audits.

It was not until January this year, approximately a year after the cyberattack, that the education office requested the three schools submit personal information protection self-assessment forms.

The forms required school officials to indicate whether they had implemented measures such as providing privacy training for staff handling personal information, adhering to the principle of collecting only necessary personal data and educating third-party service providers on data protection.

In February, the education office also organized training for personal information protection officers at foreign schools in Seoul. However, seven of the 16 schools, including the Asia Pacific International School, Korea Kent Foreign School, the Japanese School in Seoul and the French School of Seoul, did not attend.

All three schools affected by the PowerSchool breach attended the training session.

The Korea Herald contacted SFS and YISS to ask whether they had conducted independent security assessments or implemented additional safeguards following the breach, but neither had responded as of press time.

Korea International School told The Korea Herald it had discovered the unauthorized access on Jan. 9, 2025, after reviewing its system logs, and immediately reported the incident to the relevant education authorities and the Korea Internet and Security Agency.

It also notified students, parents and faculty of the breach that day and provided guidance on preventing phishing and identity fraud.

The school said it had since strengthened its cybersecurity measures, including signing a three-year contract with British data security firm 9ine in April 2025 to conduct annual security reviews and vulnerability assessments. It also replaced and upgraded its network firewalls and backbone equipment in November 2025.

KIS confirmed that it continues to use PowerSchool's student information management system, saying it had reviewed a final investigation report by PowerSchool and cybersecurity firm CrowdStrike.

KIS said PowerSchool had confirmed that security patches and stronger account controls were implemented, adding that it had received no reports of secondary harm, including identity theft, among members of its school community.

Broader concerns over student data security

Meanwhile, the data obtained by Yun showed that approximately 27,000 personal information records were compromised across schools in Seoul between 2022 and September 2026, raising broader concerns the protection of personal information in educational institutions.

The Seoul education office has also continued to maintain contractual relationships with Icecream Media, a domestic education technology company that suffered a separate data breach in March involving the personal information of approximately 200,000 elementary school teachers.

Since March, education authorities in Seoul have signed a total of 41,935 procurement and service contracts with the company, according to the report.

Yun called for more oversight of education technology providers, particularly those that continue to serve schools after experiencing data breaches.

"If schools have no choice but to continue using companies that have suffered personal information breaches, education authorities must thoroughly verify whether the security vulnerabilities have been addressed," Yun said.