PowerSchool and Bain Face Legal Setback in Data Breach Lawsuit A California federal judge has partially denied motions to dismiss a lawsuit against PowerSchool Holdings Inc. and Bain Capital, allowing data breach claims from individual users and school districts to proceed. The plaintiffs allege that after Bain’s merger with PowerSchool, the company offshored cybersecurity functions to contractors, leading to vulnerabilities that exposed sensitive data. The lawsuit centers on a cyber incident affecting nearly 50 million individuals, with claims that the offshoring of data-management tools enabled vendors to bypass consent protocols and access protected school district systems. The ruling, issued on Wednesday in the U.S. District Court for the Southern District of California, rejects Bain’s attempt to fully dismiss the case, signaling potential legal and financial repercussions for the companies involved. The decision underscores growing scrutiny over third-party cybersecurity risks and corporate accountability in large-scale data breaches. Further proceedings will determine liability and potential damages.

Bain Capital Faces Legal Action Over PowerSchool Data Breach, Setting Precedent for Private Equity Liability A federal judge in California has allowed a lawsuit against Bain Capital to proceed, marking a potential turning point in holding private equity (PE) firms accountable for cybersecurity failures at acquired companies even those predating the acquisition. The case stems from a massive data breach at PowerSchool, a K-12 education software provider, which exposed the personal data of 60 million students and 10 million teachers across North America. ### The Acquisition and Breach Timeline Bain Capital acquired PowerSchool in a $5.6 billion deal that closed on October 1, 2024, following negotiations that began in August 2022. However, the breach originated before the acquisition in August 2024, when a threat actor used stolen vendor credentials to infiltrate PowerSchool’s systems. Initial data exfiltration from a single school district occurred in September 2024, but the full scope of the breach went undetected until December 28, 2024, when the hacking group ShinyHackers demanded a ransom. The stolen data transferred to a cloud provider in Ukraine included Social Security numbers, medical records, financial details, addresses, disability records, and custody information. PowerSchool publicly disclosed the breach on January 7, 2025, prompting multiple class-action lawsuits. ### Legal Ruling and Allegations Against Bain On March 18, 2026, the U.S. District Court for the Southern District of California ruled that claims against Bain could proceed, rejecting the firm’s motion to dismiss. The court found sufficient evidence to support allegations that Bain: - Ratified cost-cutting measures that included layoffs of domestic cybersecurity staff. - Held pre-closing veto rights over major expenditures, vendor contracts, and workforce changes. - Replaced PowerSchool’s entire board post-acquisition. - Directed the offshoring of IT and cybersecurity functions, including tools that bypassed consent protocols, enabling unauthorized access. - Failed to assess risks from the offshoring it mandated. - Oversaw layoffs of critical IT staff, including at least 5% of the workforce. The court dismissed Bain’s argument that a "disclaimer of control" clause in the acquisition agreement shielded it from liability, ruling that the firm’s actions demonstrated de facto control over PowerSchool’s operations. ### Broader Implications for Private Equity The ruling suggests that PE firms may face legal exposure for cybersecurity failures at portfolio companies, even if breaches occurred before acquisition. The case underscores the need for thorough pre- and post-acquisition cybersecurity due diligence, particularly when restructuring operations or reducing costs. While the litigation remains ongoing, the decision signals a potential shift in how courts view parent company liability in data breach cases especially when PE firms exert operational control over acquired entities.