If you’re a student or teacher — or were one in the past few decades — you may be getting a head’s up soon that your personal information was accessed as part of the widespread PowerSchool cyber breach that recently hit school boards across Canada.
Those whose social insurance numbers were accessed in the massive cyberattack in late December are being notified, the Newfoundland and Labrador Department of Education announced Tuesday.
In that province, the breach included information from more than 270,000 students dating back to 1995, with 75 per cent of the affected data belonging to those no longer in the K-12 system, the department said. It also involved more than 14,000 teachers, dating back to 2010.
PowerSchool — a cloud-based software provider used by dozens of Canadian K-12 school boards to manage student info and communications — has been doing damage control since informing clients across Canada and the U.S. of the incident earlier this month.
Parents and caregivers across Canada were informed of a data breach involving software named PowerSchool, which is used across North America to store student information.
Boards in Ontario, Saskatchewan, Alberta, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, Manitoba and the Northwest Territories are among those affected by the massive breach, which occurred between Dec. 22 and 28 via a compromised back-end technical account supporting school board clients.
In the weeks since, the company has been investigating and gradually updating affected school districts about the scope of student and staff data impacted, as well as how far back it stretches. PowerSchool told boards the accessed data has been deleted and said there is no evidence of “malware or continued unauthorized activity” in its systems.
Some of Canada’s largest school divisions have been affected. For instance, the Toronto District School Board previously told CBC News it believes data from 1.49 million students (registered from September 1985 to December 2024) was included. Since contact info for past students may not be current, the TDSB is also posting incident-related updates to a central website, spokesperson Ryan Bird said.
The affected info can vary depending on school division, from personal details, such as names, home and email addresses, medical notes (such as allergies) and student numbers, to things like grades, emergency contacts or disciplinary notes. In certain cases, social insurance numbers of educators and staff were included.
“If you are a parent or guardian of a student under the age of majority and your student’s information was exfiltrated from their district’s PowerSchool SIS (Student Information System), you will receive a notification email from PowerSchool over the next few weeks,” the company said in a statement.
PowerSchool is setting up free identity and credit monitoring for two years for those whose information was involved, “regardless of whether an individual’s social security number was exfiltrated,” as well as a call centre to answer questions.
It has enlisted Experian, a consumer credit reporting bureau, to provide identity protection services for affected Canadian students and educators, and TransUnion, also a consumer credit reporting agency, for credit monitoring for those who have reached the age of majority.
Details on how to enrol will be coming in the next few weeks, PowerSchool said, adding that individuals should remain vigilant as it would “never contact you by phone or email to request your personal or account information.”
The company said it’s also in the process of filing notifications about the incident with Canadian and U.S. regulators.
Calling the personal information of kids “particularly sensitive,” federal privacy commissioner Philippe Dufresne confirmed last week that the incident is on his radar, as well as that of his provincial and territorial counterparts.
“My office is in contact with the company to obtain more information about this breach,” he said. “This will allow us to convey our expectations to the company regarding their response to the breach and to determine next steps.”
School boards across the country, including the Calgary Board of Education, have revealed details about a major data breach connected to PowerSchool in late December. Some boards revealed student data dating back decades may be impacted. Experts say there are steps families can take to protect themselves.