In Re PowerSchool Holdings, Inc., and PowerSchool Group, LLC Customer Data Security Breach Litigation

-1-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF CALIFORNIA
IN RE: POWERSCHOOL
HOLDINGS, INC. AND
POWERSCHOOL GROUP, LLC
CUSTOMER SECURITY BREACH
LITIGATION.
)
)
)
)
)
)
)
)
Case No.: 25-md-03149-BEN-MSB
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT
MOVATE, INC.’s MOTION TO
DISMISS THE SCHOOL DISTRICT
DIRECT ACTION FIRST AMENDED
CONSOLIDATED COMPLAINT
(TRACK 2)
[Dkt. 366]
I. INTRODUCTION
This multidistrict litigation arises from a data breach involving Defendants
PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively,
“PowerSchool”). PowerSchool provides cloud-based data management software for
students and educators in K-12th. PowerSchool stores sensitive student medical,
academic, and other personally identifiable information in a searchable format.
Powerschool entered into a subcontract with Defendant Movate, Inc. for computer
technology support services.
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 1/15

-2-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Defendant Movate moves to dismiss the Track 2 School District Direct Action
First Amended Consolidated Master Complaint and the three claims therein brought
specifically against Movate. For the reasons set forth below, the Court GRANTS IN
PART and DENIES IN PART Movate’s motion.
II. BACKGROUND1
It is alleged that PowerSchool is a Sacramento-based provider of educational
management software used by schools. Schools require students, parents, and teachers to
provide PowerSchool with sensitive personally identifiable information (“PII”), and
PowerSchool stores and maintains this data. There are approximately 4,700 school
customers, 4,668,000 teachers and 43,800,000 students affected by Powerschool’s
maintenance of PII. Powerschool, according to the Complaint, holds out its school
software product as being a secure repository of PII data.
On December 20, 2024, the criminal group ShinyHunters used the stolen employee
credentials of a Powerschool cybersecurity subcontractor (Movate, Inc.) to access
PowerSchool’s student information system through its PowerSource portal. The
hacker(s) exfiltrated PII and demanded a ransom from Powerschool. Powerschool paid
the ransom.
There are two groups of plaintiff school districts. This Order addresses only one of
the Track 2 groups. The School District Direct Actions First Amended Consolidated
Master Complaint (“DAC”) (Dkt. 288) sets forth 46 claims for relief. The Complaint
asserts three claims against Movate: Negligence (DAC Count 8), Negligent Hiring and
1 	When deciding whether to grant a motion to dismiss, the court generally accepts as
true all well-pleaded factual allegations. Ashcroft v. Iqbal, 556 U.S. 662, 664 (2009).
The Court is not making findings of fact, but summarizing some of the allegations made
in the 250 page, 46 claim, School District Direct Actions First Amended Consolidated
Master Complaint (filed September 12, 2025) (Dkt. 288) (“DAC”).
Movate has not moved to dismiss the other Track 2 Plaintiffs’ School District
Amended Class Action Complaint (“CAC”) (Dkt. 263) which sets out eight claims for
relief.
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 2/15

-3-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Supervision (DAC Count 9), and Breach of Contract—Third Party Beneficiary (DAC
Count 10). The Complaint alleges that the breach compromised the PII of approximately
50 million individuals, PII including social security numbers, medical information,
financial information, addresses, disability records, and custody information.
Movate is a Delaware corporation headquartered in Texas. PowerSchool hired
Movate to provide technical support, customer service, network operations, and platform
configuration for its online platform. According to the Complaint, PowerSchool gave
Movate employees extensive access to the SIS and sensitive PII of students, their
families, faculty, and teachers.
Plaintiffs claim that the attackers used the credentials of Rayson Cruz, a Movate
employee in the Philippines with access to PowerSchool’s SIS. Multiple school districts
reportedly identified a “Remote Support connection from the user ‘Rayson Cruz’” as a
key sign of compromise. Plaintiffs assert that Movate failed to implement basic,
industry-standard security measures, including credential rotation, multi-factor
authentication, restrictions on employee access to PII, and proper training and
supervision for employees and vendors.
III. APPLICABLE LAW
Under FRCP Rule 12(b)(2), “[i]n general, the court may exercise personal
jurisdiction over an out of state defendant consistent with both the forum state’s long-arm
statute and constitutional due process.” Palomar Health v. Am. Guar. & Liab. Ins. Co.,
2021 WL 4035005, at *2 (S.D. Cal. Sept. 3, 2021), aff’d, 2022 WL 3006356 (9th Cir.
July 28, 2022). “Where . . . the motion is based on written materials and affidavits rather
than an evidentiary hearing, a plaintiff is only required to make a ‘prima facie showing of
jurisdictional facts to withstand the motion to dismiss.’” Id.; Schwarzenegger v. Fred
Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004); Tokio Marine & Nichido Fire Ins.
Co. v. Precision Trucking, 2009 U.S. Dist. LEXIS 139910, at *7 (S.D. Cal. Oct. 16,
2009).
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 3/15

-4-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
In determining whether a plaintiff has satisfied his burden, uncontroverted
allegations in the complaint are taken as true. Id. On the other hand, bare bones
assertions of minimum contacts with the forum or legal conclusions unsupported by
specific factual allegations do not carry a plaintiff’s pleading burden. Id. (citing Swartz v.
KPMG LLP, 476 F.3d 756, 766 (9th Cir. 2007)).
Specific jurisdiction requires a showing that: (1) the defendant purposefully
availed itself of the forum or purposefully directed its activities toward the forum; (2) the
claim arises out of or relates to the forum-related conduct; and (3) the exercise of
jurisdiction would be reasonable. Schwarzenegger, 374 F.3d at 802.
A motion to dismiss under FRCP 12(b)(6) tests the legal sufficiency of the claims
alleged in the complaint. Under FRCP 8, a complaint should include a “short and plain
statement of the claim showing that the pleader is entitled to relief,” and may be
dismissed under Rule 12(b)(6) if the plaintiff fails to state a cognizable legal theory or
has not alleged sufficient facts to support such a theory. Somers v. Apple, Inc., 729 F.3d
953, 959 (9th Cir. 2013). The court construes the alleged facts in the light most favorable
to the plaintiff. See Retail Prop. Trust v. United Bhd. of Carpenters & Joiners of Am.,
768 F.3d 938, 945 (9th Cir. 2014). However, “courts are not bound to accept as true a
legal conclusion couched as a factual allegation.” Iqbal, 556 U.S. at 678.
To survive a motion to dismiss, a complaint must state a claim to relief that is
plausible on its face. Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550
U.S. 544, 570 (2007)). A claim has “facial plausibility when the plaintiff pleads factual
content that allows the court to draw the reasonable inference that the defendant is liable
for the misconduct alleged.” Twombly, 550 U.S. at 556. If the plaintiff’s explanation is
plausible, the complaint survives a motion to dismiss under Rule 12(b)(6), “regardless of
whether there is a more plausible alternative explanation.” Iqbal, 556 U.S. at 678.
Thus, a “Rule 12(b)(6) motion tests the sufficiency of a complaint; it does not . . .
resolve contests surrounding the facts, the merits of the claim, or the applicability of
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 4/15

-5-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
defenses.” W. Ins. Co. v. Frontier Homes, LLC, 2018 WL 8220544, at *2 (C.D. Cal.
Mar. 27, 2018) (quoting King v. Rubenstein, 825 F.3d 206, 214 (4th Cir. 2016)).
IV. DISCUSSION
A. Personal Jurisdiction
Movate argues that the Court should dismiss Plaintiffs’ claims because the Court
lacks personal jurisdiction. Movate contends that it is a Delaware corporation with its
principal place of business in Texas and Plaintiffs fail to allege purposeful, suit-related
conduct by Movate directed at California or any facts that would fairly justify pulling a
Texas-based computer tech company into this forum. As discussed in a companion
Order, the Court lacks general jurisdiction over Movate. However, it may exercise
specific jurisdiction.
The parties dispute whether purposeful direction or purposeful availment provides
the correct analytical framework for specific jurisdiction. Plaintiffs discuss purposeful
direction, arguing that this is a tort case and that Movate’s conduct was aimed at
California. Movate asserts a lack of specific jurisdiction under purposeful availment
analysis. In cases involving negligence or contract-like conduct, courts analyze whether
the defendant engaged in acts demonstrating purposeful availment rather than Calder-
style purposeful direction. See Schwarzenegger, 374 F.3d at 802–03; Holland Am. Line
Inc. v. Wartsila N. Am., Inc., 485 F.3d 450, 460 (9th Cir. 2007); Matter of Star &
Crescent Boat Co., 549 F. Supp. 3d 1145, 1162 (S.D. Cal. 2021). There is no hard line
distinction between the two approaches.
The “‘purposeful availment’ requirement ensures that a defendant will not be haled
into a jurisdiction solely as a result of ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts, or
of the ‘unilateral activity of another party or a third person.’” Burger King Corp. v.
Rudzewicz, 471 U.S. 462, 475 (1985) (internal citations omitted). A showing of
purposeful availment “typically consists of evidence of the defendant’s actions in the
forum, such as executing or performing a contract there.” Schwarzenegger, 374 F.3d at
802.
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 5/15

-6-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Movate argues that Plaintiffs have not demonstrated purposeful availment.
However, under that framework, Plaintiffs have made a prima facie showing. Plaintiffs
allege that Movate entered into a contract with PowerSchool, a California-based
company, to provide technical support, customer service, network operations, and
configuration services for PowerSchool’s SIS. Plaintiffs further assert that, under that
contract, Movate intentionally accessed California computer systems, including
PowerSchool’s SIS, and provided services to PowerSchool’s California school-district
customers. Although Movate argues that the contract was nationwide and that its work
was done remotely, those points do not negate jurisdiction at this stage. 	By servicing a
multi-state school software system that contains sensitive information, including that of
California students, parents, and teachers, Movate can be said to have assumed the
benefits and responsibilities of operating as a California company and supporting data
systems that affect California residents. See Burger King, 471 U.S. at 475-76, 480.
The second prong is also satisfied. Plaintiffs allege that the breach occurred
through the misuse of credentials belonging to a Movate employee who had access to
PowerSchool’s SIS and that Movate’s failures to implement multi-factor authentication,
credential rotation, least-privilege access, and adequate training enabled the breach.
Accepting those allegations as true, the Plaintiffs’ claims stem directly from Movate’s
conduct related to the forum and demonstrate the “something more” required. See
Panavision Int’l, L.P. v. Toeppen, 141 F.3d 1316, 1322 (9th Cir. 1998).
As to reasonableness, once the first two prongs are met, Movate bears the burden
of presenting a compelling case that jurisdiction would be unreasonable. See Glob.
Commodities Trading Grp., Inc. v. Beneficio de Arroz Choloma, S.A., 972 F.3d 1101,
1107 (9th Cir. 2020). 	The relevant factors—including California’s interest in
adjudicating claims involving the alleged compromise of sensitive information belonging
to its residents and the efficiency of resolving those claims in this MDL—do not support
dismissal. See CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1079 (9th Cir.
2011).
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 6/15

-7-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Movate downplays its role by describing itself as only “providing technical support
remotely from outside the state, including employees located abroad, on behalf of its
client, Powerschool under a contract governed by New York law,” calling it an
“incidental, background commercial relationship.” The Direct Action School Districts
Complaint paints a different picture of Movate providing technical support for a software
product requiring technical competency across internet information flow and computer
network maintenance for hundreds of schools and their millions of students and teachers
affecting the safe-keeping of extremely important personal information data. The alleged
role of Movate may have been a commercial relationship in the background, but it is
hardly plausibly described as “incidental.” The Complaint adequately demonstrates
Movate’s purposeful availment of the forum.
Since the first two elements are shown in Plaintiffs’ favor, the exercise of
jurisdiction is presumptively reasonable and the burden shifts to Movate to present a
compelling case of unreasonableness. CollegeSource, Inc., 653 F.3d at 1079. This,
Movate has not done. None of the seven factors articulated by the Ninth Circuit in
CollegeSource demonstrate that it would be unfair for Movate to defend itself in this
forum. Id. And although Movate says it has, “no operational presence in the state,”
Plaintiffs point out that Movate’s website lists an office location in San Jose, California
and has been registered to do business in California since 2000 with an actively registered
business agent here. The Direct Action School Plaintiffs sufficiently allege facts
supporting the fair exercise of personal jurisdiction over Defendant Movant. The motion
to dismiss for lack of personal jurisdiction is denied.
B. Negligence
Movate next argues that even if Plaintiffs can establish personal jurisdiction, the
Complaint fails to state a negligence claim against Movate because it owed no duty to
Plaintiffs, and Plaintiffs do not allege facts showing that Movate breached any such duty.
To establish a negligence claim, Plaintiffs must demonstrate duty, breach,
causation, and injury. Vasilenko v. Grace Family Church, 3 Cal. 5th 1077, 1083 (2017).
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 7/15

-8-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
“The existence of a duty is a question of law.” Id. The Court finds that Plaintiffs have
sufficiently stated a plausible negligence claim upon which relief can be granted.
1. Duty and Breach
Movate argues it owed no duty to the Direct Action School District Plaintiffs.
Movate argues that the foreseeability of a breach does not create a duty, by itself. But the
Complaint alleges more than foreseeability by itself. Movate says that it had no special
relationship with the Plaintiffs because it is just a commercial service provider steps
removed. 	But the Complaint does allege a special relationship, a special hazard, and a
special undertaking.
Movate uses an analogy of a bank’s online system describing Powerschool as the
bank and Movate as a bank customer. Using this analogy, Movate argues that the bank’s
online security vulnerabilities are not the customer’s fault. Applying the analogy,
Movate defends itself by saying Powerschool (like the bank) set up the internet security
protocols and it (like the customer) was simply using the Powerschool protocols already
in place. As such, it had no duty to do more, goes the argument.
A better analogy is that of a grammar school and fenced schoolyard in a
neighborhood known for predators and criminals. The Plaintiffs are like the school
requiring vulnerable children to be on its campus. Powerschool is like a school
contractor hired to erect fencing and gates and padlocks around the schoolyard to keep
the children safe within. Movate is like the security guard team hired by Powerschool to
walk the fence line and rattle the gates and provide support to ensure the enclosure is
secure. Movate attempts to deflect its alleged breach of duty by arguing Powerschool (in
this analogy) should have built better gates with bigger padlocks and Movate’s security
guards were not responsible for the security setup they were given. But the better
analysis in this schoolyard analogy is that Movate’s school security guard team was well
aware of the vulnerable children inside and the dangerous predators and criminals outside
yet Movate (as the security guards in this analogy) negligently left the gates open and the
padlocks on the ground. The allegations in the Complaint plausibly allege that Movate
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 8/15

-9-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
knew of the precious and valuable content of student and faculty PII, could foresee the
likelihood of an attempt to exfiltrate the PII by criminals and predators, and negligently
left the internet gates open with the data padlocks left on the ground.
Under California law, a defendant has a general duty of reasonable care when their
conduct creates a risk of harm. Brown v. USA Taekwondo, 11 Cal. 5th 204, 214 (2021).
Where the defendant did not itself create the risk, a duty to protect may nonetheless arise
from a special relationship with the plaintiff—one marked by dependency, control, and
other indicia—even absent contractual privity. Id. at 215–16; In re Accellion, Inc. Data
Breach Litig., 713 F. Supp. 3d 623, 633–35 (N.D. Cal. 2024) (applying Brown’s
framework and Regents factors to find a special relationship between a data-transfer
company and data subjects despite no privity); Bass v. Facebook, Inc., 394 F. Supp. 3d
1024, 1039 (N.D. Cal. 2019) (failure to comply with minimum data-security standards
constitutes a classic negligence claim); In re Facebook, Inc. Consumer Priv. Litig., 402 F.
Supp. 3d 767, 799 (N.D. Cal. 2019) (defendant had responsibility to handle sensitive
information with care); Castillo v. Seagate Tech., LLC, 2016 WL 9280242, at *3 (N.D.
Cal. Sept. 14, 2016) (defendant duty-bound to protect personal identifying information it
obtained). Courts in other jurisdictions have applied the same principle. See In re USAA
Data Sec. Litig., 621 F. Supp. 3d 454, 469 (S.D.N.Y. 2022); Weekes v. Cohen Cleary
P.C., 723 F. Supp. 3d 97, 103 (D. Mass. 2024).
Here, Plaintiffs allege that Movate had broad access to and control over their
private information, understood its sensitivity, and publicly touted compliance with
recognized data-security standards. Plaintiffs also allege that Movate failed to put in
place basic safeguards, even though credential-based attacks on school systems were
predictable and well-publicized. At the pleading stage, these allegations sufficiently
establish a duty and breach of the duty. Courts have recognized that the pleading
standard for breach in data-breach negligence cases is not high, as the occurrence of a
breach itself permits a reasonable inference of inadequate security at the pleading stage.
See Schmitt v. Sn Servicing Corp., No. 2:18-cv-00133-JAM-CKD, 2021 WL 3493754, at
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 9/15

-10-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
5 (E.D. Cal. Aug. 9, 2021) (quoting Flores-Mendez v. Zoosk, Inc., No. C 20-04929
WHA, 2021 WL 308543, at 4 (N.D. Cal. Jan. 29, 2021)) (when a breach occurs, the thing
speaks for itself). Here, Plaintiffs go further. The Complaint points out specific failures:
inadequate training on credential security; failure to rotate employee credentials; failure
to implement least-privilege access; failure to require multi-factor authentication; and
failure to limit access to private information.
2. Causation
The Complaint plausibly alleges causation. Plaintiffs allege that the breach was
carried out using the compromised credentials of a Movate employee and that the breach
would not have occurred had Movate required multi-factor authentication, rotated
credentials, and limited employee access. Under the authorities cited by the parties, the
intervention of third-party criminals does not sever causation where the defendant’s
negligence allegedly created the risk that materialized. See Lugtu v. Cal. Highway
Patrol, 26 Cal. 4th 703, 725 (2001) (“It is well established that when a defendant's
negligence is based upon his or her having exposed the plaintiff to an unreasonable risk
of harm from the actions of others, the occurrence of the type of conduct against which
the defendant had a duty to protect the plaintiff cannot properly constitute a superseding
cause that completely relieves the defendant of any responsibility for the plaintiff's
injuries.”). At this stage, Plaintiffs need only plausibly allege that Movate’s conduct was
a substantial factor in bringing about the harm.
Movate emphasizes that its systems were not breached and that PowerSchool
owned the underlying platform and core security settings. That point may bear on the
ultimate allocation of responsibility. It does not defeat causation at the pleading stage.
3. Damages
Plaintiffs have adequately alleged cognizable damages. The Complaint alleges
compromise of sensitive information, including Social Security numbers and medical
information, as well as actual misuse, dark-web exposure, fraudulent activity, credit
monitoring expenses, and time spent responding to the breach. Those allegations suffice
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 10/15

-11-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
at the pleading stage. See In re Shield Health Care Grp., Inc. Data Breach Litig., 721 F.
Supp. 3d 152, 161 (D. Mass. 2024); Accellion, 713 F. Supp. 3d at 637.
Each of the requirements to state a common law claim of negligence under any of
the relevant states’ jurisprudence is satisfied by the plausible allegations set forth in the
Plaintiff’s Complaint. Movate’s motion to dismiss the negligence claim is DENIED.
C. Negligent Hiring or Negligent Supervision
Movate next argues that Plaintiffs’ negligent hiring and supervision claim fails
because Plaintiffs do not allege that Movate knew or should have known of any specific
risk posed by its employee, Rayson Cruz.
An employer may be liable for harm caused by negligent hiring, supervision, or
retention of an incompetent employee, but the plaintiff must allege facts showing the
employer knew or should have known that keeping the employee posed a risk of the
specific harm that materialized. See Diaz v. Tesla, Inc., 598 F. Supp. 3d 809, 832–33
(N.D. Cal. 2022); Gray v. Schenectady City Sch. Dist., 86 A.D.3d 771, 773 (N.Y. App.
Div. 2011).
Plaintiffs’ theory extends beyond a propensity claim targeting a single employee.
They allege systemic failures in training and supervision, including failures to require
credential rotation, restrict access to sensitive information, and train employees in data
security practices. At the pleading stage, those allegations are sufficient. Plaintiffs allege
that Movate, acting as PowerSchool’s agent, had a duty to hire qualified employees and
to train and supervise them properly, especially since those employees had access to
sensitive information. Plaintiffs further claim that systemic failures foreseeably
contributed to the breach. Movate remonstrates that it is plausible that Movate acted with
due care in its hiring and supervision of Mr. Cruz. That may prove to be true on
summary judgment or at trial. But Plaintiffs’ allegations plausibly allege a claim of
negligent hiring, training, or supervision, even without allegations of a prior specific
tendency toward misconduct by the employee whose credentials were used. See In re
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 11/15

-12-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Bank of Am. Cal. Unemployment Benefits Litig., 674 F. Supp. 3d 884, 926 (S.D. Cal.
2023).
Movate’s motion to dismiss the negligent hiring and supervision claim is
DENIED.
D. Breach of Contract Intended to Benefit Plaintiffs
Movate’s last contention is that the breach of contract claim based on Plaintiffs as
direct intended beneficiaries fails to state a claim for relief because Plaintiffs are not
parties to the contract between Movate and PowerSchool, and they are not mentioned as
intended beneficiaries. To state a claim for relief, it is important that the Plaintiffs
plausibly allege facts showing the contract was intended for their direct benefit, otherwise
the law does not recognize a claim where a plaintiff is simply an incidental beneficiary.
Under New York law, only an intended beneficiary of a contract may assert a
claim as a third party. Vista Co. v. Columbia Pictures Indus., Inc., 725 F. Supp 1286,
1296 (S.D.N.Y. 1989) (citations omitted). “An intended beneficiary is one whose ‘right
to performance is appropriate to effectuate the intention of the parties to the contract and
either the performance will satisfy a money debt obligation of the promisee to the
beneficiary or the circumstances indicate that the promisee intends to give the beneficiary
the benefit of the promised performance.’” Id. (citations omitted). While the obligation
to perform to the third party plaintiff need not necessarily be expressly stated in the
contract (id.), “the intent to benefit a third party must be shown and the benefit must not
be merely incidental but immediate to such a degree as to indicate the assumption of a
duty to make reparation if the benefit is lost.” Strauss v. Belle Realty Co, 98 A.D. 2d 424
*6 (N.Y. App. Div. Dec. 27, 1983) (citations omitted).
Both parties point to the Global Services Agreement (“GSA”) agreement between
Powerschool and Movate.2 See Movate’s MTD Dkt. 366, at n.8 and Exh. “A” to
2 The GSA is a contract entered into on March 28, 2022 between Powerschool and
Movate, Inc., formerly known as SlashSupport, Inc. doing business as CSS Corp.
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 12/15

-13-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Declaration of J.D. White. They just differ about whether the terms of the GSA evince
an intent to directly benefit the Direct Action School Districts. The School District
Plaintiffs say it does and then point to Section 1.5 and 5.5 of the Data Privacy Agreement
(“DPA”) which is an amendment to the main contracts between Movate and
Powerschool, rather than pointing to the GSA. See Oppo. Dkt 381, at 14. The DPA is an
eight page agreement. Section 1.5 simply define what are education records. Section 5.5
defines Movate as a “school official” for purposes of the federal Family Educational
Rights and Privacy Act (“FERPA”) and imposes an obligation to abide by the FERPA
limitations and requirements imposed on school officials.
Next, the Plaintiffs point to Section 10.7 of the GSA which describes an obligation
of Movate to “assist” Powerschool in notifying victims in the event of a data breach. It
does not impose an obligation on Movate to notify schools or students on its own.
Plaintiffs then refer back to DPA Sections 2 and 15.1. Section 2 simply describes the
purpose of the agreement – which is to describe Movate’s responsibilities for handling
and protecting Powerschool’s customer data. Section 15.1 is no more than an
acknowledgement that Powerschool’s customer data may include personal data from
education records. Plaintiffs conclude by asserting that the language of these various
subsections, when taken together, demonstrate that Plaintiffs are the intended
beneficiaries.
The argument is unpersuasive. At most, the agreements demonstrate Powerschool
required Movate to treat data with care and security for Powerschool’s own benefit and in
the event of a breach for Movate to assist Powerschool in its notification obligations.
Beyond that, there is little to suggest that Powerschool’s contract with Movate was
intended to directly benefit the Plaintiff schools. Instead, the GSA describes ordinary
contractual intent such that one party, Movate, will work for the direct benefit of the
other party, Powerschool, in managing its software product in exchange for money paid.
Plaintiffs concede in their brief that the best evidence of whether the contracting
parties intended to directly benefit Powerschool’s School District customers “can be
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 13/15

-14-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
ascertained from the words of the contract itself.” Alicea v. City of New York, 534
N.Y.S.2d 983, 985 (N.Y. App. Div. 1988) (emphasis added). Here the words of the
contract do not mention the names of the School District Plaintiffs. Missing from the
words of the GSA is any provision empowering the School District Plaintiffs to enforce
the Powerschool / Movate contract. Also missing from the words of the contract are any
other terms or conditions that Movate was to directly benefit the School Plaintiffs. Like
the contract in Alicea, Plaintiffs are not signatories, and no part of the GSA or DPA refers
to the Plaintiffs as third-party beneficiaries. Id. And like the contract at issue in Alicea,
the GSA and DPA contracts are “devoid of any language showing an intent to allow
enforcement by plaintiffs.” Id.
Therefore, Plaintiffs have not successfully pleaded a plausible claim for breach of
contract as a third party intended direct beneficiary and Movate’s motion to dismiss is
granted. In the event that the Direct Action School Plaintiffs discover evidence that they
were, in fact, the intended direct beneficiaries of the Powerschool / Movate contract, they
may later move to amend their Complaint.
V. 	CONCLUSION
For the foregoing reasons, the Court ORDERS that the:
1. 	The Court exercises personal jurisdiction over Defendant Movate, Inc.
2. 	The motion to dismiss the claim for negligence (DAC Count 8) is denied.
3. 	The motion to dismiss the claim for negligent hiring, training, or supervision (DAC
Count 9) is denied.
4. 	The motion to dismiss the breach of contract claim based on the theory of intended
beneficiary (DAC Count 10) is granted.
IT IS SO ORDERED.
DATED: 	March 24, 2026
_________________________________
Hon. Roger T. Benitez
United States District Judge
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 14/15

-15-
25-md-03149-BEN-MSB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Case 3:25-md-03149-AJB-MSB Doc 444 Filed 03/24/26 PageID.<pageID> Pg 15/15