Canadian school boards among those affected by cyber incident involving third party

School boards in multiple provinces have been affected by a data breach involving software used by schools across North America to store student information.

Ontario’s Toronto, Peel and Durham district school boards issued similarly worded notices about a “cyber incident” targeting PowerSchool, a third-party application that’s also used to store some school-based staff information.

The notices say PowerSchool told school boards in Ontario and elsewhere on Tuesday that it had experienced a data breach between Dec. 22 and 28.

Officials in Ontario, Alberta, and Newfoundland and Labrador say they are working with PowerSchool to determine the extent of the breach.

PowerSchool, a U.S.-based provider of cloud software, says in a statement it has taken “all appropriate steps” to prevent further unauthorized access or misuse of the affected data.

The company says the incident is “contained,” and it does not anticipate the data will be shared or made public.

The Ontario school boards say they have notified the Information and Privacy Commissioner of Ontario about the incident.

“We know this news may be concerning, but please know that we are doing everything possible to learn more from PowerSchool about what occurred and will share that information with you,” the Toronto District School Board’s interim director of education, Stacey Zucker, wrote Wednesday in an email to parents and guardians.

Edmonton Catholic Schools posted a letter online that it received from PowerSchool.

“Our investigation determined that an unauthorized party gained access to certain PowerSchool Student Information System customer data using a compromised credential, and we regret to inform you that your data was accessed,” the letter said.

The government of Newfoundland and Labrador also issued a notice about the data breach at PowerSchool, which it said is used in the provincial education system from kindergarten to Grade 12. It said “multiple government departments” are involved in determining the next steps.

PowerSchool said it is providing services to its customers as usual as it continues to investigate the data breach.

“We take our responsibility to protect student data privacy and act responsibly as data processors extremely seriously,” it said in its statement.

This report by The Canadian Press was first published Jan. 8, 2025.

The Canadian Press