PowerSchool hackers have your kids’ info. These 3 steps can protect you

You may have heard the news about the PowerSchool breach—hackers breaking into a software system that helps schools keep track of student data, then demanding a ransom in exchange for not leaking the information. Depending on the school and its data storage practices, the student data stolen can include social security numbers, in addition to names, addresses, and birth dates.

Bad actors having your child’s name and social security number is a risk with potential far-reaching consequences. Scammers can trash their ability to open a credit card, get a bank account, land a job, or secure an apartment. And since most people don’t expect a child to be targeted this way, the damage often has long set in by the time it’s discovered.

While PowerSchool announced it would provide credit monitoring and identity protection services to affected students and staff, the notification process has rolled out in waves. That’s left a lot of down time for malicious behavior to occur—especially if you still haven’t received an email about this mitigation offer.

You don’t have to wait for PowerSchool’s aid, though. As your child’s guardian, you can take protective measures now. In addition to manually looking up the details of PowerSchool’s remediation services, three steps will help safeguard their financial reputation by halting unauthorized access to credit, banking, and tax information. Even if your children aren’t affected by this software breach, these are still smart moves to take asap. Given increasing frequency and scope of data breaches, it’s likely just a matter of time before your child is directly at risk.

Updated March 20, 2025: The final details about the PowerSchool breach have been posted to the company’s dedicated information page about the leak. A third-party investigation into the incident uncovered an earlier intrusion in August and September 2024, but it appears that data was not stolen until December. This new discovery does not change the steps recommended below.

Further reading: AI impersonators will wreck online security in 2025. Here’s what to watch out for

1. Freeze their credit reports

You may think because kids can’t legally access credit in their names, they’re safe from fraud. The opposite is true: Scammers will open credit accounts (e.g., credit cards) using stolen social security numbers, run them up, then ditch them without repayment. But because most parents don’t monitor their children’s credit reports, the fraudulent activity goes unnoticed, tanking a minor’s credit score. That in turn can affect their future ability to secure credit, an apartment, or a job.

Fortunately, locking down credit reports is free and straightforward. To freeze a credit report, you just need to submit a simple form to each of the three major credit bureaus, along with mailed proof of your identity, your relationship to the child, and your child’s identity. This usually equates to government-issued ID for yourself, and then a birth certificate and social security number card for your child.

For children under 16, guardians must fill out and submit the paperwork. Guardians can also do so for children ages 16 or 17, though these older teens can also make the request themselves.

• Experian
• Equifax
• Transunion

A fourth credit bureau exists—Innovis—though it’s not nearly as frequently used by financial institutions as the three listed above. You can freeze your child’s credit with this bureau as well for thoroughness.

For child credit freezes, you can only lift a freeze by mail. (And a bureau may also request a copy of the proof of identity.) Children can lift freezes on their own when they reach 16 years old.

2. Request an IRS identity protection PIN

Tax returns can be another target for scammers. They’ll file for a refund or claim a dependent using your child’s social security number—then leave you to deal with the resulting mess.

To thwart this scheme, apply for an identity protection PIN from the IRS. The program originally started as a way to protect victims of tax-related identity theft, but is now open to voluntary enrollment as well. Once in, your child will be sent a new six-digit PIN each year that must be used on any tax filing linked to them. Without it, the return will be rejected.

Requests for identity protection PINs can be made through the IRS website, by mail, or via an in-person appointment. Anecdotally, parents report mixed experiences with the website—mailing in Form 15227 seems to be a surer path. If you apply by mail, you will receive the identity protection PIN(s) by mail as well, in about four to six weeks after the IRS performs an identity verification over the phone. 

With tax season upon us, you should jump on this step soon.

3. Freeze their banking report

Banking reports allow banks to screen for issues with applicants—and like credit reports, you can freeze them. It prevents others from being able to open checking, savings, and other deposit accounts in your name.

The primary source for banking reports in the U.S. is ChexSystems. To initiate a security freeze for a minor, you must write out the request, then send it via mail along with the following documentation:

• A copy of the minor’s birth certificate
• A copy of the minor’s social security card
• A copy of the guardian’s driver’s license or state identification card
• Proof of address for the guardian (pay stub, utility bill, or official document bearing the address to which ChexSystems’ correspondence will be sent)
• If the guardian’s name is not on the birth certificate, a copy of documentation confirming legal guardianship (official court or legally binding document)

The written request must also include the consumer’s full name, current address, date of birth, and social security number.

One extra consideration

You may want to reserve user IDs on major services (including Google and Apple) related to your child’s name—especially if they have a unique one. It can help blunt impersonation attempts. This move is defensive; it won’t matter if your kid never uses the account when they reach legal age.

To minimize the energy you’ll need to devote to the accounts after creation, tweak their settings so you can set and forget: For email accounts, you can set them to forward all messages to your active accounts. For social media accounts, set them to private or deactivate them.

But don’t actually forget the login info. The easiest way to keep track of multiple accounts is a password manager. Paid ones offer more features, but even a good free password manager will ensure you keep access to the accounts you create.

Speaking of—you may need to login periodically to avoid running into deletion due to inactivity. Google now has a policy of two years, for example. Check each services for its policy, but logging in at least once per year often suffices for the biggest platforms.