Data on 16,000 people compromised at 3 Seoul international schools in PowerSchool breach

Almost 16,000 personal information records associated with international schools in Seoul were compromised in a December 2024 cyberattack on US-based education technology firm PowerSchool, local media reports said Monday.

The three schools affected continue to use PowerSchool's student information management system despite the data breach, raising questions over whether sufficient safeguards have been put in place to protect students, parents and faculty members.

According to a report by Maeil Business Newspaper, citing Seoul Metropolitan Office of Education data obtained by Seoul city council member Yun Yu-jin of the Democratic Party of Korea, 15,666 personal information records of students, parents and faculty were compromised across the three schools in 2025.

Korea International School accounted for the largest number of compromised records at 8,000, followed by Seoul Foreign School at 6,666 and Yongsan International School of Seoul at 1,000.

The compromised information included names, dates of birth, email addresses, home addresses, phone numbers, students' graduation years and health-related information.

The incident stemmed from a cyberattack on PowerSchool in December 2024, during which hackers stole the personal information of tens of millions of students and teachers.

PowerSchool reportedly paid the hackers in exchange for a promise to delete the stolen data. However, concerns over further misuse of the information persisted after public schools in North Carolina and education authorities in Canada received extortion emails involving the stolen data in May 2025.

Despite the breach, all three international schools reportedly continue to use PowerSchool's student information management system.

An official from the Seoul Metropolitan Office of Education told Maeil Business Newspaper that foreign schools in Korea cannot use the country's National Education Information System, making it difficult to uniformly apply domestic personal information protection guidelines.

The official said the education office had reviewed the schools' personal information management practices and sent notices urging them to exercise caution.

However, the reported inspections largely relied on self-assessments conducted by the schools themselves, rather than independent security audits.

It was not until January this year, approximately a year after the cyberattack, that the education office requested the three schools submit personal information protection self-assessment forms.

The forms required school officials to indicate whether they had implemented measures such as providing privacy training for staff handling personal information, adhering to the principle of collecting only necessary personal data and educating third-party service providers on data protection.

In February, the education office also organized training for personal information protection officers at foreign schools in Seoul. However, nine of the 16 schools did not attend.

The Korea Herald contacted all three schools to ask whether they had conducted independent security assessments or implemented additional safeguards following the breach, but none had responded as of press time.

Meanwhile, the data obtained by Yun showed that approximately 27,000 personal information records were compromised across schools in Seoul between 2022 and September 2026, raising broader concerns about the protection of personal information in educational institutions.

The Seoul education office has also continued to maintain contractual relationships with Icecream Media, a domestic education technology company that suffered a separate data breach in March involving the personal information of approximately 200,000 elementary school teachers.

Since March, education authorities in Seoul signed a total of 41,935 procurement and service contracts with the company, according to the report.

Yun called for more oversight of education technology providers, particularly those that continue to serve schools after experiencing data breaches.

"If schools have no choice but to continue using companies that have suffered personal information breaches, education authorities must thoroughly verify whether the security vulnerabilities have been addressed," Yun said.