In Re PowerSchool Holdings, Inc., and PowerSchool Group, LLC Customer Data Security Breach Litigation

-1-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF CALIFORNIA
IN RE: POWERSCHOOL
HOLDINGS, INC. AND
POWERSCHOOL GROUP, LLC
CUSTOMER SECURITY BREACH
LITIGATION.
)
)
)
)
)
)
)
)
Case No.: 25-md-03149-BEN-MSB
AMENDED
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT
POWERSCHOOL HOLDINGS, INC.
AND POWERSCHOOL GROUP,
LLC’S MOTION TO DISMISS
(TRACK 2)
[Dkt. 302]
I. INTRODUCTION
This multidistrict litigation arises from a data breach involving Defendants
PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively,
“PowerSchool”). PowerSchool provides cloud-based data management software for
students and educators in K-12th. PowerSchool stores sensitive student medical,
academic, and other personally identifiable information in a searchable format.
Powerschool moves to dismiss the Track 2 Plaintiffs' claims against it. For the
reasons set forth below, the Court GRANTS IN PART and DENIES IN PART
Powerschool’s motion.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 1/28

-2-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
II. BACKGROUND1
It is alleged that PowerSchool is a Sacramento-based provider of educational
management software used by schools. Schools require students, parents, and teachers to
provide PowerSchool with sensitive personally identifiable information (“PII”), and
PowerSchool stores and maintains this data. There are approximately 4,700 school
customers, 4,668,000 teachers and 43,800,000 students affected by Powerschool’s
maintenance of PII. Powerschool, according to the Complaint, holds out its school
software product as being a secure repository of PII data.
On December 20, 2024, the criminal group ShinyHunters used the stolen employee
credentials of a Powerschool cybersecurity subcontractor (Movate, Inc.) to access
PowerSchool’s student information system through its PowerSource portal. PowerSchool
discovered the breach on December 28, 2024, and notified customers on January 7, 2025.
The hacker(s) exfiltrated PII and demanded a ransom from Powerschool. Powerschool
paid the ransom. The Complaint alleges that the breach compromised the PII of
approximately 50 million individuals, PII including social security numbers, medical
information, financial information, addresses, disability records, and custody information.
III. APPLICABLE LAW
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal
sufficiency of the claims alleged in the complaint. Under Federal Rule of Civil
Procedure 8, a complaint should include a “short and plain statement of the claim
showing that the pleader is entitled to relief,” and may be dismissed under Rule 12(b)(6)
if the plaintiff fails to state a cognizable legal theory or has not alleged sufficient facts to
support such a theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). The
1 When deciding whether to grant a motion to dismiss, the court generally accepts as true
all well-pleaded factual allegations. Ashcroft v. Iqbal, 556 U.S. 662, 664 (2009). The
Court is not making findings of fact, but summarizing some of the allegations made in the
436 page, 81 claim, Consolidated Individual Users Class Action Complaint (filed August
11, 2025) (Dkt. 259) (“Complaint”).
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 2/28

-3-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
court construes the alleged facts in the light most favorable to the plaintiff. See Retail
Prop. Trust v. United Bhd. of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir.
2014). However, “courts are not bound to accept as true a legal conclusion couched as a
factual allegation.” Iqbal, 556 U.S. at 678.
To survive a motion to dismiss, a complaint must state a claim to relief that is
plausible on its face. Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550
U.S. 544, 570 (2007)). A claim has “facial plausibility when the plaintiff pleads factual
content that allows the court to draw the reasonable inference that the defendant is liable
for the misconduct alleged.” Twombly, 550 U.S. at 556. If the plaintiff’s explanation is
plausible, the complaint survives a motion to dismiss under Rule 12(b)(6), “regardless of
whether there is a more plausible alternative explanation.” Iqbal, 556 U.S. at 678. While
some courts disagree,2 this Court is not persuaded that a class action complaint has a
higher plausibility threshold than a garden variety complaint.
Thus, a “Rule 12(b)(6) motion tests the sufficiency of a complaint; it does not . . .
resolve contests surrounding the facts, the merits of the claim, or the applicability of
defenses.” W. Ins. Co. v. Frontier Homes, LLC, 2018 WL 8220544, at *2 (C.D. Cal.
Mar. 27, 2018) (quoting King v. Rubenstein, 825 F.3d 206, 214 (4th Cir. 2016)).
IV. DISCUSSION
There are two groups of plaintiff school districts asserting claims against
Powerschool. The School District Amended Class Action Complaint (“CAC”) (Dkt.
263) sets out eight claims for relief. The School District Direct Action First Amended
Consolidated Master Complaint (“DAC”) (Dkt. 288) sets forth 46 claims for relief.
Because both complaints are voluminous and claims for relief manifold, not all claims are
2 See e.g., Grigsby v. Valve Corp., No. C12-0553JLR, 2012 WL 5993755, at *4 (W.D.
Wash. Nov. 14, 2012) (“Plaintiffs' [class action] complaint must rise to a higher
plausibility threshold than it would if it were a garden-variety tort claim or a claim
brought by Mr. Grigsby alone.”).
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 3/28

-4-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
addressed individually and not all grounds for dismissal are mentioned and discussed.
Claims that are not specifically identified as requiring dismissal are considered to be
plausible and sufficiently pleaded for purposes of the motion to dismiss. The claims are
not addressed in numerical order but generally in the order used by the movant.
A. Joint Motion
By joint motion, three Direct Action School Plaintiffs’ claims for relief have
already been dismissed without prejudice: Count 4 (Computer Fraud and Abuse Act),
Count 23 (New York Education Law), and Count 6 (California Unfair Competition Law).
See Joint Mot. Dkt. 362; Dkt. 373.
B. 	Powerschool’s Motion to Dismiss
Powerschool seeks dismissal of the remaining claims for failure to state a claim
under Rule 12(b)(6).
1. Breach of Contract Claims
The Track Two school Plaintiffs’ primary claims against Powerschool are based on
contract agreements for Powerschool software products. Powerschool argues that the
breach of contract claims (CAC Count 1, DAC Counts 10, 13, 15, 18, 20, 24, 26, 28, 30,
33, 35, 37, 40, 42 & 44) should be dismissed for failure to plead that Powerschool
breached the contracts or that plaintiffs have not incurred resulting damages.
All Track Two Plaintiffs allege that they had contracts with PowerSchool that
required PowerSchool to perform certain actions related to the Data received from
Plaintiffs’ users, including encrypting and safeguarding that Data, and that PowerSchool
breached those contracts. CAC ¶¶ 1, 149-158; DAC passim.
a. Class Action Plaintiffs
Powerschool first objects that at no point, however, do the Class Action Plaintiffs
identify which provisions of their contracts with PowerSchool were purportedly breached
and the absence of such basic factual allegations is fatal to the Class Plaintiffs’ claims,
citing Young v. Facebook, Inc., 790 F. Supp. 2d 1110, 1117 (N.D. Cal. 2011) (“In an
action for breach of a written contract, a plaintiff must allege the specific provisions in
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 4/28

-5-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
the contract creating the obligation the defendant is said to have breached.”). But Young
does not recite a rigid rule. FRCP Rule 8(e) admonishes courts that “[p]leadings must be
construed so as to do justice.” And Rule 8(a)(2) requires no more than a “short plain
statement of the claim showing that the pleader is entitled to relief.”
The Class Action Plaintiffs use 77 pages to state eight claims. They could have
been more precise, but a passing review of Powerschool’s 12-page, single-spaced, Main
Services Agreement (“MSA”) and the associated state-specific Data Services Agreements
(“DSA”) make clear that there were written contracts that imposed obligations on
Powerschool to take careful measures to protect the personal information data of school
students and teachers. For example, Paragraph 5.1 of the New Jersey DSA says that
“Powerschool will maintain all Customer Data in strict confidence . . . .” Likewise,
Paragraph 6.1 of the DSA says that “Powerschool will safeguard and maintain the
confidentiality of Customer Data obtained from the Customer.” Similar obligations are
set out in Paragraph 7, 8, 9.4.5., and Schedule 1C, Section A.1(1-10). 	Class Plaintiffs
have not specifically identified these provisions in their Complaint, but it is obvious that
they could have. Had they done so, they would have made an already too large and
overly complicated multi-state class action pleading even more verbose. Construing the
pleading so as to do justice, as Rule 8 requires, the Class Action Plaintiffs have
adequately stated a plausible claim for breach of contract.
b. Direct Action Plaintiffs
Next, Powerschool faults the Direct Action School Plaintiffs for the opposite
condition. Powerschool objects that the DAC alleges too many contractual provisions
labeling it as an improper “shotgun pleading” and citing this Court’s decision in Borrego
Cmty. Health Found. v. Hebets, 2024 WL 1269476, at *6 (S.D. Cal. Mar. 25, 2024)
(Benitez, J.) (“Shotgun pleadings are pleadings that overwhelm defendants with an
unclear mass of allegations and make it difficult or impossible for defendants to make
informed responses to the plaintiff’s allegations.”). Hebets, however, was a quite
different context in which multiple claims were made against multiple defendants without
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 5/28

-6-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
specifying which one of the defendants was responsible for which acts or omissions, or
which of the defendants the claim is brought against. The plaintiff alleged 59 separate
claims for relief, against 40 different defendants, arising out of 12 distinct schemes to
siphon money, that took place over a decade of fraudulent conduct, and that failed to
satisfy the heightened pleading standard of FRCP Rule 9(b). Hebets is a far cry from the
type of pleading the Direct Plaintiffs have set out in their DAC.
Powerschool agrees that the Direct Plaintiffs “allege breaches of at least 100
provisions.” But Powerschool still objects arguing that they “provide no factual
allegations as to how each contractual provision was breached.” Mot. to Dismiss (Dkt.
302) at 10; see also at 14 (“While the Direct Plaintiffs identify a litany of different
statutes that PowerSchool supposedly violated, they fail to allege facts that would explain
how those statutes were violated and thus fail to allege breach of contract on those
grounds.”). The DAC is already 243 pages in length. Rule 8 does not require a lengthier
description of how each of the 100+ contract provisions were breached in order to satisfy
Rule 8.
Noting several contractual provisions that require PowerSchool to “safeguard and
maintain the confidentiality of Customer Data,” Powerschool suggests that “the parties
did not intend for a cybersecurity incident to constitute some violative ‘disclosure’ of
customer data.” However, evidence of the parties’ intent must wait for summary
judgment or trial.
Powerschool also argues that the Direct Action School Plaintiffs’ “reliance on the
mere occurrence of the Incident—unadorned by any well-pled facts regarding
PowerSchool’s vetting and monitoring practices—does not allege a breach of the duty to
supervise provisions.” But for purposes of Rule 8, the incident which is accompanied by
other well-pled facts does sufficiently allege a breach of the contractual duty to supervise
provisions. See e.g., New Jersey DSA ¶¶ 7-9.
Powerschool also takes issue with the Direct Action School Plaintiffs’ allegations
of breaches of contractual notice and incident response provisions, where PowerSchool
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 6/28

-7-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
agreed to notify the School Districts of any security incident “without unreasonable
delay,” or within a specified time period, and to assist in mitigation of any data incident.
Powerschool does not dispute the existence of these types of contract provisions but
instead says that the Direct Action School Plaintiffs do not plausibly identify damages
arising from the supposed delay in notification, and so their claims should be dismissed
for lack of damages, citing In re MOVEit Customer Data Sec. Breach Litig., 2025 WL
2179475, at *27 (D. Mass. July 31, 2025). MOVEit addressed a delay in notification
claim arising under the California Customer Records Act (Cal. Civ. Code § 1798.82(a)),
rather than a simple breach of contract claim based on a contractual obligation. The DAC
sufficiently pleads damages arising from the alleged breach of contract.
c. Limitation of Liability -- CAC and DAC
Powerschool’s arguments hit much harder when it asserts that both the Class
Action and Direct Action School Plaintiffs seek damages that are barred in substantial
part by the MSA’s Limitation of Liability clause (¶¶ 11.1, 11.2). Powerschool points out
that in addition to their request for general damages, Plaintiffs seek special damages,
expectation damages, consequential damages, and incidental damages. (CAC ¶ 158;
DAC ¶¶ 353, 393, 434, 482, 524, 608, 674, 710, 774, 827, 891, 949, 1011, 1074, 1137.)
The Limitation of Liability provision in the MSA, however, makes clear that
Plaintiffs cannot recover for “any lost profits or funding, revenues, goodwill, or indirect,
incidental, consequential, cover, business interruption, or punitive damages, whether an
action is in contract or tort.” MSA § 11.1 (“TO THE MAXIMUM EXTENT
PERMITTED BY LAW, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES
BE LIABLE TO THE OTHER PARTY FOR ANY LOST PROFITS OR FUNDING,
REVENUES, GOODWILL, OR INDIRECT, INCIDENTAL, CONSEQUENTIAL,
COVER, BUSINESS INTERRUPTION OR PUNITIVE DAMAGES, WHETHER AN
ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 7/28

-8-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
LIABILITY. . . .”).3 The contract specifies in § 11.2 that the cap on monetary liability
applies “whether an action is in contract or tort and regardless of liability . . . .”
The allegations in the Track 2 Complaints, taken as a whole, plausibly allege a
garden variety breach of contract claim involving Powerschool’s numerous customer
school district entities. The Class Action and Direct Action School Plaintiffs have
stretched to mold their breach of contract claim into tort actions, such as claims for
simple negligence and negligence per se. Unfortunately for the contracting Plaintiffs, the
MSA Limitation of Liability provision (a provision set out in all capital letters in the
MSA) expressly extends to tort claims under any theory and cuts off any additional
damages. Consequently, both the Class and Direct Plaintiffs’ tort claims pleaded in
addition to simple breach of contract claims fail the plausibility test and will be dismissed
to the extent they seek such damages.
d. The Economic Loss Doctrine -- CAC and DAC
As an alternative to the Limitation of Liability argument, Powerschool says that the
negligence claims should be dismissed because Plaintiffs seek to recover economic
damages that are squarely barred by the economic loss doctrine in multiple states, and
they do not allege facts that would plausibly show that PowerSchool owed any non-
contract duty to its school district customers. Powerschool argues that in at least twelve
of the states in which Plaintiffs bring claims, they cannot recover in negligence for purely
economic losses, especially where, as here, the claim arises under a contract and is not
appropriately addressed in tort.
“The economic loss doctrine was created judicially and has been adopted in
various forms throughout the United States.” Grant Treaster, The Confusion Continues:
The New Dynamic of the Economic Loss Doctrine in Kansas, 62 U. Kan. L. Rev. 1326
3 There is also a contractual cap on monetary liability which is specified as “two times (2X) the total
amount paid by customer . . . in the twelve (12) months preceding the first incident out of which the
liability arose.” See MSA § 11.2.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 8/28

-9-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
(2014). It is a recent jurisprudential trend. “The economic loss doctrine was first
officially adopted by the California Supreme Court in the 1965 case of Seely v. White
Motor Co.” Id. at 1330. In its most basic form, the economic loss doctrine bars plaintiffs
from making tort claims based on only economic losses. The doctrine is most typically
applied to product liability claims.
“The economic loss doctrine has been labeled “obscure,” “confusing,” and
“concerning.” Id. at 1325. Nevertheless, in 1986 the Supreme Court adopted the
doctrine in an admiralty case. See E. River S.S. Corp. v. Transamerica Delaval, Inc., 476
U.S. 858, 872–73 (1986). The Court explained, “[c]ontract law, and the law of warranty
in particular, is well suited to commercial controversies of the sort involved in this case
because the parties may set the terms of their own agreements. The manufacturer can
restrict its liability, within limits, by disclaiming warranties or limiting remedies. In
exchange, the purchaser pays less for the product. Since a commercial situation generally
does not involve large disparities in bargaining power, we see no reason to intrude into
the parties' allocation of the risk.” The Court continues, “[a] warranty action also has a
built-in limitation on liability, whereas a tort action could subject the manufacturer to
damages of an indefinite amount. The limitation in a contract action comes from the
agreement of the parties and the requirement that consequential damages, such as lost
profits, be a foreseeable result of the breach.” Id. at 874.
The same allocation of responsibilities supports the application of the doctrine in
this case. Powerschool, through the MSA, intended to restrict its liability, within limits,
by limiting remedies. In exchange, the theory goes, the school district Plaintiffs were
able to pay less for the Powerschool product. Since the commercial situation did not
involve large disparities in bargaining power, the parties thereby fairly allocated the risks.
This case, then, falls squarely within the rationale of the economic loss rule, which the
Supreme Court famously said prevents “contract law [from] drown[ing] in a sea of tort.”
Id. at 866; see also Serifos Mar. Corp. v. Glencore Singapore Pte Ltd., No. 24-1303-CV,
2025 WL 1554798, at *3 (2d Cir. June 2, 2025) (“The District Court also correctly
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 9/28

-10-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
dismissed Serifos's gross negligence cause of action as duplicative of its breach of
contract claim. ‘It is a well-established principle’ under New York law ‘that a simple
breach of contract is not to be considered a tort unless a legal duty independent of the
contract itself has been violated.’”); In re Snowflake, Inc., Data Sec. Breach Litig, 2025
U.S. Dist Lexis 212557*18 (D. Mont. 2025) (“The economic loss doctrine precludes
recovery in tort for alleged negligence on a topic covered by a contract unless a plaintiff
also can demonstrate noneconomic losses . . . .”).
The School District Plaintiffs allege economic losses stemming from the alleged
breach of the contracts with Powerschool. They claim in a general fashion that they
incurred damages consisting of “inflated contract prices”; “additional wages”; “increased
workload”; cybersecurity expenses and legal fees; costs for transferring data, security
implementation, and training; “lost opportunity costs”; credit monitoring costs; identity
theft protection expenses; ongoing monitoring costs; notification expenses; hotline costs;
and administrative expenses. (CAC ¶ 80; DAC ¶¶ 136, 348, 388, 429, 477, 519.) These
claims are foreclosed by the contract Limitation of Liability clause, as discussed above.
Even if the limitation of liability provision did not apply, these additional economic
losses claimed by the School District Plaintiffs would be barred by the economic loss
doctrine.
Powerschool alternatively argues that there is no tort duty that it owes to the school
district customers. “Regardless of the Court’s application of the economic loss doctrine,
Plaintiffs’ claims still fail. A negligence claim requires a plaintiff to establish that a duty
was owed to them.” Although it may be the case that there is no particular duty owed by
Powerschool to its school district entity customers, the Court need not reach a decision on
this question because the negligence tort claims are foreclosed by the contractual
limitation of liability and the economic loss doctrine. After all, as Powerschool
persuasively argues, even assuming Plaintiffs can allege a general common law duty to
safeguard personal information, that duty is not one that PowerSchool would owe to the
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 10/28

-11-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Track Two Plaintiffs which are schools and school districts that merely collected the
personal information belonging to individual students and teachers.
2. Negligence Per Se Claims
The Direct Action School Plaintiffs plead negligence per se as a separate claim
(Count 2), while the Class Action Plaintiffs plead negligence per se as part of their
negligence claim. Powerschool moves to dismiss both. The motion to dismiss the
negligence per se claims, whether alleged as a separate count or as a theory of
negligence, will be granted for the same reasons as Plaintiffs’ simple negligence claims.
3. Unjust Enrichment Claims (CAC Count 7, DAC Count 3)
In addition to their simple breach of contract claims against Powerschool, the
School District Plaintiffs assert claims for unjust enrichment. (CAC Count 7, DAC
Count 3). Powerschool moves to dismiss. The motion is granted.
The general rule is summed up like this: “as a matter of law, a quasi-contract
action for unjust enrichment does not lie where, as here, express binding agreements exist
and define the parties' rights. When parties have an actual contract covering a subject, a
court cannot—not even under the guise of equity jurisprudence—substitute the court's
own concepts of fairness regarding that subject in place of the parties' own contract.”
California Med. Ass'n, Inc. v. Aetna U.S. Healthcare of California, Inc., 94 Cal. App. 4th
151, 172 (2001). In a similar case, where a person’s PII was exfiltrated in a data breach
in New Jersey the court found that she could not assert an unjust enrichment claim
against an insurer to which she gave her PII explaining, “[t]he FAC lacks any allegations
that Defendant benefited from Plaintiff's PII, by, for example, selling the data or
otherwise commercially profited from same. Without this, Plaintiff's unjust enrichment
claim fails.” Adkins v. Everest Glob. Servs., Inc., No. CV 23-004 (RK), 2024 WL
3887127, at *12 (D.N.J. Aug. 21, 2024).
In this case the school Plaintiffs (which are artificial entities) lost no PII of their
own. There are no allegations that a school or school district lost in the data breach its
own social security number, date of birth, age, or health information from which
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 11/28

-12-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Powerschool was unjustly enriched by, for example, selling such PII data. There appears
to be nothing given by Plaintiffs to Powerschool by which Powerschool was enriched or
profited over and above the contracted amounts paid. The theory of unjust enrichment in
the context presented by this case, viewing the CAC and DAC as a whole, simply does
apply. Like the New York court points out in In re Waste Mgmt. Data Breach Litig.,
2022 WL 561734, at *6 (S.D.N.Y. Feb. 24, 2022), in a typical data breach case it is the
“third-party hackers [that] benefitted at the expense of both the plaintiffs and [the data
breached defendant], and it is that person or persons which in equity and good conscience
owes restitution to the plaintiffs.” The unjust enrichment claims are dismissed.
4. Fraudulent Concealment Claim (DAC Count 5)
Only the Direct Action Plaintiffs assert a claim against Powerschool for fraudulent
concealment. (DAC Count 5). Powerschool moves to dismiss on two grounds. First, it
argues that the complaint does not satisfy the heightened pleading standard required by
FRCP Rule 9(b). That is correct. More importantly, even if the more stringent
requirements of Rule 9(b) were to be satisfied, the Direct Action Plaintiffs would be
unable to plausibly allege that PowerSchool had a duty to disclose concealed information
that is separate and apart from its contractual duty to perform under their contracts. The
motion to dismiss is granted.
5. The Federal CFAA (CAC Count 4, DAC Count 4)
Both groups of Track Two Plaintiffs put forth claims that Powerschool violated the
federal Computer Fraud and Abuse Act, 18 U.S.C. Section 1030, et seq. The CFAA is a
criminal statute defining a crime of improperly accessing a protected computer.
Musacchio v. United States, 577 US 237, 240 (2016). “Hacking” is a useful euphemism
for unauthorized or criminal access to a computer network. Although hacking does not
appear in the text, the CFAA is fairly described as an anti-hacking statute. See United
States v. Nosal, 676 F.3d 854, 857-58 (9th Cir. 2012). “CFAA violations require a
person to engage in the hacking . . . .” Koninklijke Philips N.V. v. Elec-Tech Int’l Co.,
2015 WL 1289984, at *4 (N.D. Cal. Mar. 20, 2015). Plaintiffs do not claim Powerschool
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 12/28

-13-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
engaged in hacking or was the hacker that infiltrated its own system to exfiltrate PII and
demand from itself a ransom for the return of its PII. That would be a novel claim.
But Plaintiffs appear to allege facts describing a different, but equally novel, crime.
Plaintiffs allege Powerschool made contractual promises to Plaintiffs that it would in
essence keep student and teacher PII safe from hackers. Plaintiffs then allege that
Powerschool negligently breached its contractual promises in various ways thereby acting
without authorization and in criminal violation of the CFAA. In the process,
Powerschool left open a network vulnerability which a third-party criminal Shiny Hunter
actor took advantage of in order to exfiltrate Plaintiffs’ PII. See CAC paras 184-209.
The CFAA does not reach so far. As the Ninth Circuit said in Nosal, construing the
statute that way would “expand its scope far beyond computer hacking to criminalize any
unauthorized use of information obtained from a computer.” 676 F.3d at 859. “This
would make criminals of large groups of people who would have little reason to suspect
they are committing a federal crime.” Id.
Instead, Plaintiffs point to provisions of the CFAA as the basis for Powerschool’s
alleged liability. See CAC ¶ 185 (citing 18 U.S.C. §§ 1030(a)(2)(C) & (a)(5)(C)); DAC
¶¶ 201-02 (citing 18 U.S.C. §§ 1030(a)(4) & 1030(a)(5)(B)). But Plaintiffs do not allege
that Powerschool was the hacker of its own computers. Each of these CFAA provisions
requires the defendant to have accessed a computer either “without authorization” or in a
manner that “exceeds authorized access,” and to have done so either knowingly or
intentionally. The weak point of this claim is that Powerschool, of course, accessed its
own computers with authorization. How could it be otherwise? Plaintiffs by contract
hired Powerschool to use its computers to continually access and maintain Plaintiffs’ data
as Plaintiffs’ needs required. Additionally, a plaintiff must allege they have suffered
“damage or loss by reason of [the CFAA] violation.” 18 U.S.C. § 1030(g). At bottom,
Plaintiffs’ theory is something along the lines of: we gave Powerschool our students’ data
to maintain and store so it would be in a useful format, but Powerschool did not actually
have our authorization to maintain or store the data in the careless way that it did and
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 13/28

-14-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
when it did we suffered a loss and Powerschool violated the CFAA. The claim is
implausible in its present form. Rather, Plaintiffs’ allegations demonstrate that
PowerSchool was the victim of an outside hacker. Because Plaintiffs have failed to
plausibly allege any of these elements, their CFAA claims are dismissed.
6. The State CDAFA (CAC Count 5)
The Class Action Plaintiffs assert a claim under California Penal Code § 502
known as the California’s Comprehensive Data Access and Fraud Act (“CDAFA”). The
CDAFA, like the CCDA, is a criminal statute. Plaintiffs piggyback onto their CFAA
allegations using similar language and theories for their CDAFA claim. CAC ¶ 222. As
described in paragraphs 184 through 209 of the CAC, the Class Action Plaintiffs claim
that in addition to violating the CFAA, PowerSchool violated the CDAFA by knowingly
and without permission accessing, using, or damaging, Plaintiffs’ and Class Members’
data; using Computer Services; assisting in unauthorized access; and causing
unauthorized access to Plaintiffs’ and Class Members’ Computer Systems, including in
furtherance of a scheme to defraud and to wrongfully obtain data and property.
Powerschool moves to dismiss for two reasons.
First, argues Powerschool, the CDAFA does not apply because PowerSchool did
not actually participate in unauthorized hacking, which is a requirement for liability
under the Act. Powerschool suggests that courts have recognized that the CDAFA is not
meant to impose liability on a defendant when it is a third-party hacker that gains
unauthorized access to a defendant’s system. See Claridge v. Rock You, Inc., 785 F.
Supp. 2d 855, 863 N.D. Cal. 2011). Claridge is persuasive. Claridge strictly construed
the CDAFA statute because it is a criminal statute and found that the legislature intended
to reach third party hackers, rather than firms that may have “failed to provide a
sufficiently secure computer system.” Id. at 863.
The Class Plaintiffs retort that the CDAFA creates broader liability than the CFAA
in that it predicates liability on as little as “knowing access” rather than unauthorized
access, relying on Facebook, Inc. v. Power Ventures, 844 F.3d 1058, 1069 (9th Cir.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 14/28

-15-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2016). Perhaps so, but Facebook was addressing a different context where authorized
access had been formally withdrawn (in a cease and desist letter to the defendant) after
which the defendant acted to circumvent Facebook’s IP barriers to knowingly gain
systems access. Id. at 1068. That is not the allegation in the present case. Therefore,
Powerschool’s motion to dismiss is granted for the CDAFA claims.
7.The Illinois Biometric Privacy Act (DAC Count 17)
The Illinois’ Biometric Privacy Act (“BIPA”) regulates the collection, use, and
handling of biometric data. It applies only to entities “in possession of” biometric data.
See 740 Ill. Comp. Stat. 14/15(e). The Direct Action Plaintiffs claim Powerschool
violated the Act’s restrictions on possession of biometric data. “As a private entity in
possession of this data containing biometric identifiers and biometric information,
PowerSchool was required to do the following pursuant to 740 Ill. Comp. Stat. Ann.
14/15(e): . . . .” DAC ¶ 457. Plaintiffs assert that PowerSchool collects biometric
information of students because: it “enables students and others to log in to its
smartphone application, PowerSchool Mobile, by using biometric identifiers including
Face ID, Touch ID, or Secure ID.” DAC ¶¶ 34, 456. Under the Act, a firm that
possesses such data is required to use the reasonable standard of care used within the
firm’s industry and in a manner that is at least as protective as the way the firm protects
other sensitive information. Plaintiffs allege that standard of care was not met, and that
“Biometric information is contained within the data that was compromised.” DAC at ¶
461.
Courts have recognized that allegations such as “PowerSchool enabled users to log
in to a mobile app with Face ID or Touch ID” would not suffice to allege that
PowerSchool received such data. G.T. v. Samsung Elecs. Am. Inc., 742 F. Supp. 3d 788,
796 (N.D. Ill. 2024) (dismissing BIPA claim where plaintiff merely alleged that
defendant controlled an app and its technology, but not that defendant had control over
biometric information generated from the app). G.T. is persuasive. But Plaintiffs go
farther and allege that Powerschool also possessed such data -- which was not the case in
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 15/28

-16-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
G.T. Powerschool takes a better approach when it argues that even if it did possess such
data, Plaintiffs do not allege that they themselves provided any biometric information to
PowerSchool. According to the Complaint, it is not the students or other humans who
provided biometric data that are the named plaintiffs in Track Two. Plaintiffs here are
Illinois school entities. Consequently, the Court concludes that the Direct Action School
Plaintiffs are not the “person[s] aggrieved” with the right to bring a private action under
the BIPA. For all of these reasons, the motion to dismiss the Illinois biometric data claim
is granted.
8. The Consumer Protection Statute Claims (CAC Count 6, DAC
Counts 12, 14, 16, 19, 21, 22, 25, 27, 29, 31, 34, 38, 41, 43 & 45)
The Class Plaintiffs bring a claim under the California Unfair Competition Law
(“UCL”) (CAC Count 6), and the Direct Action Plaintiffs bring claims under the state
consumer protection statutes of 14 additional states (collectively, the “Consumer
Protection Claims”).
a. California UCL Claim by Class Action Plaintiffs
Powerschool moves to dismiss the Class Action Plaintiffs’ California UCL claim
(Count 6) arguing, first, that the Class Plaintiffs are not located in California and
therefore cannot bring an extraterritorial claim under California’s UCL. Powerschool is
correct that the application of California law is limited by the presumption against
extraterritorial application. The California Supreme Court has said that “[n]either the
language of the UCL nor its legislative history provides any basis for concluding the
Legislature intended the UCL to operate extraterritorially. Accordingly, the presumption
against extraterritoriality applies to the UCL in full force.” Sullivan v. Oracle Corp., 51
Cal. 4th 1191, 1207 (2011). Consequently, California generally does not extend the
application of the UCL beyond state lines. See, e.g., Diva Limousine, Ltd. v. Uber
Techs., Inc., 392 F. Supp. 3d 1074, 1094 (N.D. Cal. 2019) (“It is well-established that the
UCL does not apply extraterritorially.”). The Class Plaintiffs cannot bring a UCL claim
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 16/28

-17-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
because they cannot show a “clearly expressed” legislative intent to apply the UCL
extraterritorially.
Secondly, Powerschool argues that the Class Plaintiffs cannot proceed under the
UCL because they do not allege lacking an adequate remedy at law. The Court agrees.
Zaback v. Kellogg Sales Co., 2020 WL 6381987, at *4 (S.D. Cal. Oct. 29, 2020)
(dismissing UCL claim due to plaintiff’s failure to plead he lacked an adequate remedy at
law); Sonner v. Premier Nutrition Corp., 971 F.3d 834, 845 (9th Cir. 2020) (“Regardless
of whether California authorizes its courts to award equitable restitution under the UCL .
. . when a plain, adequate, and complete remedy exists at law, we hold that federal courts
rely on federal equitable principles before allowing equitable restitution in such
circumstances. And because [plaintiff] fails to demonstrate that she lacks an adequate
legal remedy in this case, we affirm the district court's order dismissing her claims for
restitution.”). Therefore, Powerschool’s motion to dismiss the Class Plaintiffs’ UCL
claim (Count 6) is granted.
b. State Consumer Protection Laws -- Direct Action Plaintiffs
The Direct Action Plaintiffs bring state law statutory claims under the laws of 15
states.
i. New York, Rhode Island, Utah, Vermont, and Virginia
Powerschool asserts that claims under the New York, Rhode Island, Utah, Vermont,
and Virginia statutes should be dismissed because Plaintiffs cannot allege, as these
statutes generally require, that its software product was primarily used for personal,
family, or household use. For example, Utah’s statute applies only to a “consumer
transaction” for goods or services for “primarily personal, family, or household
purposes.” Utah Code Ann. § 13-11-3(2)(a)(i) (emphasis added). Vermont’s statute is
similarly intended to protect a person as defined as follows: “Consumer” means any
person who purchases, leases, contracts for, or otherwise agrees to pay consideration for
goods or services . . . for the person's use or benefit or the use or benefit of a member of
the person's household, or in connection with the operation of the person's household or
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 17/28

-18-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
a farm. . . . “ Vt. Stat. Ann. tit. 9, § 2451a(1) (emphasis added). The claim based on
Oklahoma’s consumer protection statute (Count 43) falls into the same camp. The
Oklahoma statute “gives a private right of action only to ‘an aggrieved consumer.’”
Patterson v. Beall, 19 P.3d 839, 846 (Okla. 2000).
The Direct Action Plaintiffs disagree, but their rationale is unpersuasive. The
Direct Action School Plaintiffs explain that Powerschool’s products are used by the
students and families that they serve. Therefore, the Direct Action School Plaintiffs
propose, that “Plaintiffs are consumers acting as the vector through which persons,
families, and households use Powerschool’s products.” Oppo. (Dkt. 343) at 31
(emphasis added). The weakness of the argument is that these types of statutes are
intended to protect human consumers rather than “vectors” or corporate intermediaries.
Consequently, Powerschool’s argument for dismissing these types of consumer
protection claims is more persuasive.
The exception is New York’s statute, as Plaintiffs point out. New York’s statute
does not have the same limiting “personal use” requirement; the New York statute
protects businesses as well as individual consumers from deceptive advertising. See Gen.
Bus. Law §§ 349. Therefore, Powerschool’s motion to dismiss is granted as to the
Rhode Island (Count 34), Utah (Count 12), Vermont (Count 25), Virginia (Count 38),
and Oklahoma (Count 43) consumer protection claims; the motion to dismiss is denied as
to the New York Gen. Bus. Law section 349 (Count 21) statutory claim.
ii. California and Wisconsin
Powerschool also argues that both the Class Action and the Direct Action School
Plaintiffs’ consumer protection claims, whether under the states addressed above or the
remaining states, fail for additional reasons. In particular, Powerschool says that
Plaintiffs’ allegations assert that PowerSchool made misrepresentations and omissions
about its data security practices and procedures. See CAC ¶¶ 233(d)-(g) (California);
DAC ¶¶ 359-65 (Utah), 397-402 (Wisconsin). Because these claims sound in fraud,
Plaintiffs must satisfy the heightened pleading standard of Federal Rule of Civil
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 18/28

-19-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Procedure 9(b). For Rule 9(b), a plaintiff must state with particularity the “who, what,
where, and when of the allegedly false or fraudulent representation.” In re MOVEit, 2025
WL 2176590, at *3; Sony I, 996 F. Supp. 2d at 959 (requiring pleading of “time, place,
and specific content of the false representations as well as the identities of the parties to
the misrepresentation”). The Utah claim is dismissed above. The California and
Wisconsin claims as pleaded do not sound primarily in fraud so as to require Rule 9(b)
pleading specificity so Powerschool’s motion to dismiss on this ground is denied. But
Powerschool has other theories and objections to the remaining state law statutory claims.
iii. Arizona, South Carolina, New York, Tennessee, Utah,
Vermont, Virginia, Washington, and Wisconsin
Powerschool next argues more generally that “most of the statutes at issue require
a causal link between the alleged misrepresentation and the plaintiffs’ claimed injury,”
and/or reliance on the allegedly deceptive conduct. Powerschool then maintains that
Plaintiffs do not allege when, how, or even if they saw PowerSchool’s advertisements or
marketing materials, much less that they relied on them to their detriment, pointing to
integration clauses in the MSA agreements.
For example, the Powerschool contracts with the plaintiff schools expressly
provide that “[e]ach Party acknowledges that it has not made any promise or
representation that is not expressed in this Agreement.” MSA § 14.9. Consequently,
Powerschool argues that the Direct Action School Plaintiffs do not plausibly allege
reliance on Powerschool’s misleading advertising which would be necessary to recover
under these typical consumer protection state statutes. The Court agrees.
Take the Direct Action School Plaintiffs’ claim made under Arizona’s consumer
protection statute (Count 41). In that claim, the school Plaintiffs allege: “PowerSchool
published on its website the statement that PowerSchool ‘invests in updated security
technology and adheres to strict security regulations’ while representing on its website
that it supposedly did these acts to ‘keep your data secure.’ Also, through its website,
PowerSchool represented itself as an ‘industry leader for protected private data.’
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 19/28

-20-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
PowerSchool made representations to members of the public that they could ‘trust’
PowerSchool to safeguard and protect children's personal information.” See DAC ¶1018
(emphasis added). The school Plaintiffs’ South Carolina consumer protection act claim
(Count 19) is similar. The claim alleges: “PowerSchool repeatedly advertised on its
website that PowerSchool ‘invests in updated security technology and adheres to strict
security regulations’ while representing that it did so to ‘keep your data secure.’ Also
through its website, PowerSchool advertised itself as an ‘industry leader for protected
private data.’ PowerSchool continually used advertisements and promotions of its
services to make representations to members of the public that they could ‘trust’
PowerSchool to safeguard and protect children's personal and private information.” DAC
at ¶ 490 (emphasis added); see also Utah (Count 12) at ¶ 360 (same); Vermont (Count
25) at ¶615 (same); Washington (Count 45) at ¶1144 (same); New York (Count 22) at ¶
549 (“PowerSchool published on its website the statement that PowerSchool ‘invests in
updated security technology and adheres to strict security regulations’ while representing
on its website that it did so to ‘keep your data secure.’ Also through its website,
PowerSchool represented itself as an ‘industry leader for protected private data.’”)
(emphasis added); Tennessee (Count 29) at ¶ 715 (“Before entering into contracts with
the Tennessee Districts and throughout the duration of the Parties' commercial
relationship, PowerSchool published in promotional, marketing, and advertising
materials statements. . . .”) (emphasis added); Virginia (Count 38) at ¶ 954 (“Both before
entering into contracts with the Virginia Districts and throughout the duration of the
Parties' commercial relationship, PowerSchool published in promotional, marketing, and
advertising materials statements . . . .”) (emphasis added).
In each of these claims the Direct Action School Plaintiffs plead that they relied on
misleading statements that were part of advertising or website statements made to the
general public. At the same time, however, the school Plaintiffs allege that they each
entered into direct written contracts with Powerschool with full integration clauses.
Applying the federal plausibility standard for pleading, the school Plaintiffs’ claims that
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 20/28

-21-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
they relied on advertising statements rather than the actual negotiated terms of the MSA
agreements fall short of satisfying the plausibility requirement. The relied upon
consumer protection statutes do not contemplate placing liability where a sophisticated
entity is the consumer and that entity enters into a written contract that excludes the
allegedly misleading general advertising statements. Plaintiffs do not cite cases to the
contrary.
Therefore, because the claims discussed above lack plausible allegations of
reliance or causation in view of the written MSAs, Powerschool’s motion to dismiss the
consumer protection claims based upon the consumer protection statutes of the states of
Arizona, South Carolina, New York (Gen. Bus. Law section 350), Tennessee, Utah,
Vermont, Virginia, Washington, and Wisconsin, is granted.
iv. Idaho, New Hampshire and Pennsylvania
In a similar vein, the Direct Action School Plaintiffs allege Powerschool misled
them and are thus liable under the consumer protection statutes of Idaho (Count 27), New
Hampshire (Count 31) and Pennsylvania (Count 36). However, rather than claiming
Powerschool made misleading affirmative statements in its public statements, for these
claims the school Plaintiffs assert that Powerschool made omissions about weaknesses in
its data security. Here is an example from the Idaho consumer protection statute claim
(Count 27) at ¶ 682: “The Idaho Districts justifiably acted or relied to their detriment
upon PowerSchool's omissions of fact concerning the above-described omissions and
representations regarding PowerSchool's data security practices and procedures, as
evidenced by their purchase of PowerSchool's products and services.” (Emphasis added.)
The New Hampshire consumer protection claim similarly relies on omissions
(Count 31) at ¶¶ 779-781: “In purchasing PowerSchool's products and services, the New
Hampshire Districts were deceived by PowerSchool's failure to disclose that
PowerSchool, contrary to its representations, did not: a. properly encrypt data; b.
implement multi-factor authentication; c. monitor for unauthorized access; d. ensure that
its staff was adequately trained to recognize and respond to cyber threats; e. regularly and
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 21/28

-22-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
proactively patch vulnerabilities that could be exploited by hackers; and f. properly
isolate sensitive student and teacher data from other less secure systems. The New
Hampshire Districts reasonably relied on PowerSchool's omissions, and they did not and
could not unravel PowerSchool's deception on their own. PowerSchool's concealment,
suppression, and omission of material facts were likely to and did in fact deceive
reasonable consumers.” (Emphasis added); see also DCA Count 36 (Pennsylvania) at ¶
896 (“PowerSchool . . . failed to disclose the truth about the measures and protocols it
implemented to protected data containing PII that was entrusted to it, and did so with the
intent that consumers rely on that failure to disclose in deciding whether to purchase its
EdTech products and services.”) (emphasis added).
Applying the federal plausibility standard for pleading, the Direct Action School
Plaintiffs’ claims that they were misled by omissions beyond the actual negotiated terms
of the MSA agreement fall short of satisfying the plausibility requirement. The
applicable consumer protection statutes do not contemplate placing liability where a
sophisticated entity is the consumer and that entity enters into a written contract that
excludes any other statements or omissions. And again, Plaintiffs do not cite cases to the
contrary.
Therefore, because the claims discussed above lack plausible allegations of
reliance or causation in view of the written MSAs, Powerschool’s motion to dismiss the
consumer protection claims based upon the consumer protection statutes of the states of
Idaho, New Hampshire and Pennsylvania, is granted. 4
4 Powerschool makes an alternative argument that in order to correctly plead a claim
based on unlawful, unfair, or unconscionable conduct under several of the state statutes,
they must allege that PowerSchool’s conduct offends established public policy, is
“immoral, unethical, oppressive, unscrupulous,” or substantially injurious to consumers,
citing Ahern v. Apple Inc., 411 F. Supp. 3d 541, 579-80 (N.D. Cal. 2019) (Illinois, New
Hampshire, North Carolina); Okla. Stat. Ann. tit. 15, § 752(14) (Oklahoma); Ames v.
Oceanside Welding & Towing Co., 767 A.2d 677, 681 (R.I. 2001) (Rhode Island) (“In
looking to determine whether a practice is “unfair” under the statute, this Court considers:
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 22/28

-23-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
9. The New Hampshire, Virginia, and Washington Data Breach
Notification Laws (DAC Counts 32, 39 & 46)
The Direct Action School Plaintiffs also assert claims alleging violations of the
data breach notifications laws of New Hampshire, Virginia and Washington (Counts 32,
39 & 46). 	Powerschool moves to dismiss because Plaintiffs do not allege facts
demonstrating PowerSchool’s notification was unreasonably delayed or that they were
injured by any delay in receiving notice.
New Hampshire’s statute requires one to “notify and cooperate with the owner or
licensee of the information of any breach of the security of the data immediately
(1) Whether the practice, without necessarily having been previously considered
unlawful, offends public policy as it has been established by statutes, the common law, or
otherwise-whether, in other words, it is within at least the penumbra of some common-
law, statutory, or other established concept of unfairness; (2) whether it is immoral,
unethical, oppressive, or unscrupulous; (3) whether it causes substantial injury to
consumers (or competitors or other businessmen).”); World Cam, LLC v. Omnibond Sys.,
LLC, 2021 WL 4132100, at *6 (D.S.C. Sept. 9, 2021) (South Carolina) (“A trade practice
is ‘unfair’ when it is offensive to public policy or when it is immoral, unethical, or
oppressive; a practice is ‘deceptive’ when it has a tendency to deceive.”); Picket Fence
Preview, Inc. v. Zillow, Inc., 623 F. Supp. 3d 371, 382 (2022) (Vermont) (the Vermont
Supreme Court has reiterated that in order to recover for an alleged violation of § 2453 of
the VCPA, a plaintiff must establish that they are a consumer); Taylor v. Amazon.com,
Inc., 2025 WL 104381, at *5 (W.D. Wash. Jan. 15, 2025) (Washington) (“To prevail in a
private CPA claim, the plaintiff must prove (1) an unfair or deceptive act or practice, (2)
occurring in trade or commerce, (3) affecting the public interest, (4) injury to a person's
business or property, and (5) causation.”); Cotte v. CVI SGP Acquisition Tr., 2022 WL
464307, at *10 (D. Utah Feb. 15, 2022) (Utah) (“And Plaintiffs have failed to allege any
facts specifically demonstrating unconscionability, must less any facts that would rise to
the level of “extreme unfairness” required to constitute unconscionability.”).
Powerschool argues that Plaintiffs do not explain how their allegations of negligent or
inadequate cybersecurity countermeasures rise to the level of “immoral,” “unethical,”
“oppressive,” or the equivalent.
Because these state consumer protection statutory claims are dismissed for other
reasons, the argument is not resolved here.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 23/28

-24-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
following discovery. . . .” N.H. Rev. Stat. Ann. § 359-C:20. Virginia’s statute provides
that notice of a data breach is to be given “without unreasonable delay.” However, it also
provides that, “[n]otice required by this section may be reasonably delayed to allow the
individual or entity to determine the scope of the breach of the security of the system and
restore the reasonable integrity of the system.” Va. Code Ann. § 18.2-186.6(B)
(emphasis added). Washington’s data breach notification statute provides, [n]otification
to affected consumers under this section must be made in the most expedient time
possible, without unreasonable delay, and no more than thirty calendar days after the
breach was discovered . . . .” Wash. Rev. Code Ann. § 19.255.010(8) (emphasis added).
The Direct Action School Plaintiffs here simply allege: “Powerschool breached that
obligation.” DAC at ¶1165.
When the plausibility requirement is applied for evaluating these three claims for
alleged delay, the school Plaintiffs do not state claims upon which relief may be granted.
Powerschool’s breach announcement is alleged to have been initiated only ten days after
the breach was discovered including weekends and national holidays. Ten days of
“delay” is reasonable and would likely satisfy the notice obligations imposed by any of
these three state statutes. Therefore, Powerschool’s motion to dismiss the Direct Action
School Plaintiffs’ claims alleging violations of the data breach notifications laws of New
Hampshire, Virginia, and Washington (Counts 32, 39 & 46) is granted.
10. Express Indemnity (DAC Count 6)
The Direct Action School Plaintiffs also assert a claim for indemnification, which
is premised upon a provision in the MSA specifying that PowerSchool “will defend
Customer . . . from and against any claim, demand, suit or proceeding brought by a third
party against a Customer” under certain circumstances. DAC ¶ 245; MSA § 10.1.
Powerschool asks that this claim be dismissed because the Direct Action School Plaintiffs
do not identify any actual third-party claim as of today that would make their indemnity
claim ripe for adjudication. The Plaintiffs instead seek declaratory relief, “whereby this
Court will use its authority under 28 U.S.C. §§ 2201, et seq., to issue a declaration that, in
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 24/28

-25-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
the event that Plaintiffs are sued as a result of PowerSchool’s failure to adequately secure
the PII at issue, Plaintiffs will be indemnified.” DAC ¶ 247 (emphasis added). The
Declaratory Judgment Act (“DJA”) does require an “actual controversy.” 28 U.S.C. §
2201(a) (emphasis added). And a “claim is not ripe for adjudication if it rests upon
contingent future events that may not occur as anticipated, or indeed may not occur at
all.” On the other hand, the Plaintiffs state a claim that is plausible. The claim may or
may not eventually prove to be ripe by the time of trial, but permitting the claim to go
forward rather than requiring an amendment later better serves scarce judicial resources.
Therefore, the motion to dismiss Count 6 is denied.
11. Class Action Plaintiffs’ Claim for Declaratory And
Injunctive Relief (CAC Count 8)
The Class Action Plaintiffs state a claim for declaratory and injunctive relief Count
8). Powerschool moves to dismiss. The Declaratory Judgment Act mainly provides a
remedy, not an independent cause of action. City of Reno v. Netflix, Inc., 52 F.4th 874,
878–79 (9th Cir. 2022) (“We agree with our sister circuits that have considered the issue
that the Declaratory Judgment Act does not provide an affirmative cause of action where
none otherwise exists.”).5
Here, because the Class Action Plaintiffs other claims for relief may proceed and
because Plaintiffs’ declaratory judgment claim is predicated on those claims, the Class
Action Plaintiffs have sufficiently established a plausible claim for declaratory relief and
injunctive relief. Therefore, Powerschool’s motion to dismiss the Class Action Plaintiffs’
Count 8 is denied.
5 “A plaintiff's inability to rely on the Declaratory Judgment Act to obtain affirmative
relief where no cause of action otherwise exists contrasts with the well-established
availability of the Act for defensive use against anticipated claims. See Peterson v.
Highland Music, Inc., 140 F.3d 1313, 1322 (9th Cir. 1998) (observing that, “[f]requently,
the point of a declaratory action is to assert a defense anticipatorily”).” City of Reno, 52
F.4th at 879.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 25/28

-26-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
V. 	CONCLUSION
For the foregoing reasons, the Court ORDERS that the:
1. 	The Class Action Plaintiffs and the Direct Action School Plaintiffs’ claims for
breach of contract are sufficiently pleaded.
2. 	The Class Action and the Direct Action School Plaintiffs’ simple negligence
claims and other tort claims pleaded in addition to the simple breach of contract claims
found at CAC Count 1 and DAC Counts 10, 13, 15, 18, 20, 24, 26, 28, 30, 33, 35, 37, 40,
42 and 44 do not satisfy the plausibility test and are dismissed.
3. 	The Direct Action School Plaintiffs’ claims for economic losses stemming from
the alleged breach of the contracts with Powerschool (i.e., “inflated contract prices”;
“additional wages”; “increased workload”; cybersecurity expenses and legal fees; costs
for transferring data, security implementation, and training; “lost opportunity costs”;
credit monitoring costs; identity theft protection expenses; ongoing monitoring costs;
notification expenses; hotline costs; and administrative expenses) (CAC ¶ 80; DAC ¶¶
136, 348, 388, 429, 477, 519) are foreclosed by the contract Limitation of Liability clause
or the economic loss doctrine and are dismissed.
4. 	The negligence per se claims, whether alleged as a separate count or as a theory of
negligence, are dismissed for the same reasons as Plaintiffs’ simple negligence claims.
5. 	The claims for unjust enrichment by the Class Action Plaintiffs (CAC Count 7) and
the Direct Action School Plaintiffs (DAC Count 3) are dismissed.
6. 	The Direct Action School Plaintiffs’ Fraudulent Concealment Claim (Direct Action
Count 5) is dismissed.
7. 	The Class Action Plaintiffs and the Direct Action School Plaintiffs’ CFAA Claims
(CAC Count 4, DAC Count 4) are dismissed.
8. 	The Class Action Plaintiffs’ CDAFA Claim (CAC Count 5) is dismissed.
9. 	The Direct Action School Plaintiffs’ Illinois Biometric Privacy Act Claim (DAC
Count 17) is dismissed.
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 26/28

-27-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
10. 	The Class Action Plaintiffs’ UCL claim (CAC Count 6) is dismissed, as previously
stipulated.
11. 	The Direct Action School Plaintiffs’ claims under the consumer protection statutes
of Rhode Island (Count 34), Utah (Count 12), Vermont (Count 25), Virginia (Count 38),
and Oklahoma (Count 43) are dismissed.
The claim based on New York’s Gen. Bus. Law section 349 (Count 21) is
sufficiently pleaded.
12. 	The Direct Action School Plaintiffs’ claims under the consumer protection statutes
of the states of Arizona (Count 41), South Carolina (Count 19), New York’s Gen. Bus.
Law section 350 (Count 22), Tennessee (Count 29), Washington (Count 45), and
Wisconsin (Count 14), are dismissed.
13. 	The Direct Action School Plaintiffs’ claims under the consumer protection statutes
of the states of Idaho, New Hampshire and Pennsylvania, are dismissed.
14. 	The Direct Action School Plaintiffs’ claims alleging violations of the data breach
notifications laws of New Hampshire, Virginia, and Washington (Counts 32, 39 & 46)
are dismissed.
15. 	The Direct Action School Plaintiffs’ claim for express indemnity (Count 6) is
sufficiently pleaded.
16. 	The Class Action Plaintiffs’ Claim for Declaratory and Injunctive Relief (CAC
Count 8) is sufficiently pleaded.
17. 	Direct Action School Plaintiffs’ Count 4 (Computer Fraud and Abuse Act) and
Count 23 (New York Education Law) are dismissed, as previously stipulated.
IS SO ORDERED.
DATED: 	March 19, 2026
_________________________________
Hon. Roger T. Benitez
United States District Judge
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 27/28

-28-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:25-md-03149-AJB-MSB Doc 440 Filed 03/19/26 PageID.<pageID> Pg 28/28