Consumers Affected
880,000
Texas Attorney General Ken Paxton filed a lawsuit against PowerSchool, a provider of cloud-based services for K-12 schools, following a data breach that exposed the personal and health information of over 880,000 Texas school-aged children and teachers. The breach occurred in December 2024 when a hacker gained administrative access through a subcontractor's account and stole unencrypted data including Social Security numbers, medical details, and disability records. The lawsuit alleges PowerSchool violated Texas law by failing to implement basic security measures and by misleading customers about its security practices.
In-house legal teams should review all vendor agreements with education technology providers, particularly those handling student, children’s, or employee data, to ensure they include explicit requirements for multi-factor authentication, adequate access controls, and data encryption for all sensitive data. Contracts should also mandate compliance with applicable state privacy laws, require vendors to accurately represent their security standards without deceptive marketing claims, and include clear breach notification timelines and subcontractor security obligations. Additionally, teams should verify that vendors are contractually required to adhere to security best practices for protecting health information and student records, and that remedies for security failures are clearly outlined.
Entity
PowerSchool
Industry
Technology"PowerSchool"
"Texas Deceptive Trade Practices Act"
"Identity Theft Enforcement and Protection Act"
"unprecedented data breach exposed the sensitive personal identifying information and protected health information of more than 880,000 Texas school-aged children and teachers"
"failed to implement even the most basic security features, including multi-factor authentication, adequate access controls, and proper data encryption"
"provider of cloud-based services for K-12 schools"
Texas Attorney General Ken Paxton issued a consumer alert warning Texans about scams, fraudulent charities, and illegal price gouging related to severe flooding. The guidance provides resources for verifying charities and reporting suspected fraud or price gouging to the AG's office.
$150.0M
Texas Attorney General Ken Paxton secured a $150 million multistate settlement against 23andMe following a 2023 data breach that exposed genetic and personal data of 6.9 million consumers. The settlement resolves bankruptcy claims and requires enhanced data security, risk assessments, and an independent advisory board, with immediate recovery of $18 million from bankruptcy funds.
Texas Attorney General Ken Paxton opened an investigation into LinkedIn Corporation over allegations that the company advertised and profited from fake or misleading job opportunities ("ghost jobs") on its platform. The investigation focuses on whether LinkedIn misled consumers who paid for Premium subscriptions by failing to disclose that a significant percentage of job postings may be inactive or not genuine hiring opportunities.
$45.0M
Attorney General Ken Paxton secured a $45 million multistate settlement with Block, Inc. (Cash App) for misleading consumers about the safety of its platform and failing to protect users from fraud. The settlement requires Cash App to maintain 24-hour customer support, cease deceptive safety claims, and fulfill its legal duty to investigate and reimburse unauthorized transactions.
$13.0M
Texas Attorney General Ken Paxton secured a settlement with Walmart over deceptive practices in its Spark Driver program. Walmart misrepresented driver pay, including failing to pass on customer tips and altering base pay after drivers accepted offers. The $13 million settlement provides direct payments to affected Texas drivers and requires Walmart to implement honest compensation practices.
Texas Attorney General Ken Paxton announced an investigation into StubHub for failing to deliver FIFA World Cup tickets that fans purchased. The investigation focuses on reports of 'ghost ticketing,' where sellers list tickets they do not possess, collect payment, and cancel when unable to deliver.