Several school boards across Canada are grappling with the fallout of a data breach involving PowerSchool, a third-party software used to store student and staff information.
The breach, which occurred between December 22 and 28, 2024, has affected educational institutions in Ontario, Alberta, Newfoundland and Labrador, and Nova Scotia, The Canadian Press noted.
The Toronto District School Board, along with the Peel and Durham district boards in Ontario, issued statements on Tuesday, confirming that PowerSchool notified them of the incident. The software provider, based in the US, stores sensitive data for educational institutions across North America.
In their notice, school officials indicated that unauthorized access had occurred but assured the public that investigations were underway.
“We know this news may be concerning, but please know that we are doing everything possible to learn more from PowerSchool about what occurred and will share that information with you,” said Stacey Zucker, interim director of education for the Toronto District School Board.
PowerSchool has responded to the breach by taking steps to prevent further unauthorized access. The company has stated that it believes the breach is “contained” and that it does not anticipate the affected data will be shared or made public.
The breach was first identified when it was determined that an unauthorized party had gained access to customer data by compromising a credential, according to a letter posted online by the Edmonton Catholic Schools from PowerSchool.
In Newfoundland and Labrador, the provincial government issued a notice confirming the breach’s impact on the K-12 education system. Several government departments are now involved in determining how to proceed. Similarly, in Nova Scotia, the Cape Breton-Victoria Regional Centre for Education reported that it too had been affected, but the full scope of the breach remains unclear.
PowerSchool, which provides cloud-based services for education systems, has assured its clients that it is investigating the incident and is continuing its regular operations. “We take our responsibility to protect student data privacy and act responsibly as data processors extremely seriously,” it said in its statement.
The Information and Privacy Commissioner of Ontario has been notified, and other provincial authorities are taking similar steps.
Do you have something to say about this story? Share your thoughts in the comments below.
