From a school system email:
PowerSchool has informed us that they have taken action with the hackers to ensure the unauthorized data was deleted without any further replication or dissemination. They do not anticipate any of the data being shared or made public and are working with cybersecurity experts and law enforcement to ensure ongoing data safety. PowerSchool indicated they will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory obligations.
It boils down to their reputation, which is honestly the only thing they truly have.
If they have a reputation of leaking date afterwards nobody is going to pay in the future.
So afaik, they don’t resell or give it away. They also send “proof of deletion”, but how fool proof that is is another question entirely.