School Software Hack Impacts School Boards in Six Canadian Provinces
PowerSchool Cyberattack Impacts School Boards Across Canada, Exposing Sensitive Data
School boards across Canada are managing the aftermath of a major cyberattack on PowerSchool, a widely used administrative software platform.
The breach, which affected school boards in six provinces, may have compromised sensitive personal information, including student names, addresses, health card numbers, and medical details.
The U.S.-based company confirmed that unauthorized access occurred between December 19 and 23, 2024. According to PowerSchool, the attack involved “limited student and staff data.” Hackers reportedly used a compromised credential to infiltrate one of PowerSchool’s portals, PowerSource, the company said in a statement.
PowerSchool stated that the compromised data has since been deleted. The company has deactivated the affected credential and implemented stricter password and access controls to prevent future incidents.
What Was Targeted?
The breach potentially exposed data from two tables within PowerSchool’s Student Information System—a central database containing contact information for families and educators.
“Each district is going to be a little bit different in terms of what data was stolen. But this was the main table… Attackers stole essentially a roster of every kid in the district for the impacted districts,” said Mark Racine, a security consultant for school boards, in an interview with CP24.
For some customers, the exposed data may also include Social Security Numbers (the U.S. equivalent of Canadian Social Insurance Numbers), Personally Identifiable Information (PII), and limited medical and grade information, PowerSchool added.
Provincial Impacts
Alberta
Affected boards include the Calgary Board of Education and Rocky View Schools, among others. Edmonton Catholic Schools, St. Albert Catholic Schools, and Elk Island Public Schools have also informed parents about the breach.
Ontario
Toronto-area boards, including those in Peel, York, and Toronto, were impacted. The Durham District School Board confirmed its involvement but had not yet contacted the Ontario Information and Privacy Commissioner. Additional affected boards include Thunder Bay Catholic, Lakehead, and others across the province.
Manitoba
Around 16 school divisions, including Louis Riel, River East Transcona, and Brandon, reported being impacted. PowerSchool has been working with cybersecurity experts to address the breach.
The Maritimes
In Nova Scotia, the Cape Breton-Victoria Regional Centre for Education confirmed its inclusion in the breach. The Prince Edward Island government also reported possible compromises to data of students, teachers, and parents, and is collaborating with PowerSchool to assess the situation.
Accountability and Investigations
The Ontario Information and Privacy Commissioner emphasized that while schools may outsource services to vendors, they remain accountable for protecting personal information. The federal government is also conducting its own investigation into the breach.
Several school boards are still assessing the extent of the breach and its potential impact, with ongoing communication between PowerSchool and affected districts.
