A significant data breach has impacted school boards across multiple provinces in Canada, involving PowerSchool, a widely-used software for managing student information. This incident has raised concerns about the security of sensitive educational data, affecting school districts in Ontario, Alberta, and Newfoundland and Labrador.
In Ontario, the Toronto District School Board, the Peel District School Board, and the Durham District School Board have all issued notifications regarding a "cyber incident" that took place involving PowerSchool. They reported that the breach occurred between December 22 and December 28, as communicated by PowerSchool to the affected school boards on a recent Tuesday.
School officials from the impacted provinces are actively collaborating with PowerSchool to assess the extent of the breach. PowerSchool, headquartered in the United States, has stated that it is taking comprehensive measures to prevent any further unauthorized access or potential misuse of the compromised data. In its communication, the company assured that the incident is "contained" and does not foresee the data being publicly shared.
The Ontario school boards promptly informed the Information and Privacy Commissioner of Ontario in light of the data breach. Stacey Zucker, the interim director of education for the Toronto District School Board, addressed parents and guardians through an email, acknowledging the concerns surrounding the incident and emphasizing that they are committed to gathering further information from PowerSchool.
Edmonton Catholic Schools also made a letter from PowerSchool available online, which detailed the unauthorized access to customer data. According to PowerSchool’s investigation, a breached credential allowed an unauthorized party to gain access to certain data linked to their Student Information System, confirming that affected individuals would be informed about the situation.
The government of Newfoundland and Labrador has similarly issued a notice about the breach, stating that PowerSchool is integral to the provincial education system from kindergarten through Grade 12. The government emphasized that multiple departments are engaged in establishing the necessary next steps to address the breach.
As the investigation unfolds, PowerSchool has maintained that its services continue to operate as usual while they delve deeper into the data breach. The company highlighted its serious commitment to protecting student data privacy, asserting that it acts responsibly as a data processor.
This incident underscores the increasing risks associated with data management in educational institutions and the importance of stringent cybersecurity measures to safeguard sensitive information, particularly regarding students and school staff.
