PowerSchool hack exposed 15,666 records at three Seoul international schools

Personal data on 15,666 people at three international schools in Seoul leaked in 2025 through the hack of PowerSchool, the American student-records company, and all three schools still run their records on its system, Maeil Business Newspaper reported on 1 November 2026.

The figures come from the Seoul Metropolitan Office of Education, which released them to Seoul city councillor Yoon Yu-jin.

School	Records leaked
Korea Foreign School	8,000
Seoul Foreign School	6,666
Yongsan International School of Seoul	1,000

The leaked data included names, dates of birth, email and home addresses, phone numbers, pupils' graduation years and health information.

Across all of Seoul's primary and secondary schools, about 27,000 records on pupils, parents and teachers leaked between 2022 and September 2026. The three international schools account for about 60 per cent of that total.

The breach

PowerSchool was hacked in December 2024. It paid the attackers for a video that claimed to show the stolen files being deleted. In May 2025 someone used the same data to send extortion emails to public schools in North Carolina, and several Canadian school boards reported being targeted.

The regulator's response

Foreign schools in South Korea cannot use NEIS, the national school administration system, so they buy their own. An education office official said that made it hard to apply the country's data protection rules to them across the board. The office said it had looked into the schools' handling of personal data and sent them letters urging caution.

That inquiry was a form the schools filled in themselves. In January 2026, a year after the breach, the office asked the three to return a self-assessment checklist, marking O or X against items such as whether staff handling personal data had been trained and whether the schools collected only the data they needed.

In February 2026 the office ran training for the people responsible for data protection at Seoul's foreign schools. Nine of the 16 schools did not attend. The office sent them another letter.

"It is hard to see sending official letters as enough," said Hwang Seok-jin, a professor at Dongguk University's Graduate School of International Information Security. He said the authorities should check that pupils and parents had been told about the leak and tighten security checks on education technology suppliers.

Yoon said that if schools had to keep using a supplier that had been breached, the education office should confirm its security weaknesses had been fixed.