School software hack hits school boards across six Canadian provinces

CTV National News: Schools face cyber incident School boards in at least six provinces across the country revealed they were hit by a large cyber incident. Garrett Barry reports.

School boards across Canada are grappling with the fallout from a significant cyberattack on PowerSchool, a widely used administration software platform.

The breach, affecting school boards in six provinces, may have compromised sensitive personal information of students including names, addresses, health card numbers and medical details.

The U.S-based company said unauthorized access to its system occurred between Dec. 19 and 23, 2024, and involved "limited student and staff data."

PowerSchool informed school districts this week that hackers infiltrated its systems using a compromised credential to gain access to one of their portals: PowerSource, a spokesperson told CTVNewsToronto.ca in an email.

PowerSchool claims that the compromised data has since been deleted and they have deactivated the compromised credential and tightened password and access control for all accounts, according to the statement.

What was targeted?

The breach potentially exposed data from two tables housed in PowerSchool’s ‘Student Information System,’ a central database that includes contact information for families and educators, according a PowerSchool spokesperson.

“Each district is going to be a little bit different in terms of what data was stolen. But this was the main table…attackers stole essentially a roster of every kid in the district for the impacted districts,” Mark Racine, a security consultant for school boards, told CP24 in an interview.

A PowerSchool spokesperson also told CTVNewsToronto.ca that “for a certain subset of customers” these tables may also include Social Security Number (SSN), the U.S. equivalent to a Canadian Social Insurance Number, other Personally Identifiable Information (PII) and limited medical and grade information.

Alberta

Several school boards, including the Calgary Board of Education and Rocky View Schools (RVS) — the public school division that serves students to the west, north and east of Calgary — have notified parents of a breach on their system and is investigating to determine how much information was accessed.

Edmonton's Catholic, St. Albert's Catholic, Greater St. Albert Catholic Schools and Elk Island Public Schools are also among the school boards affected.

Ontario

Toronto-area school boards, including those for Peel, York and Toronto itself, are confirmed to be affected by the cybersecurity incident. Durham District school board confirmed to families they had been impacted by the data breach, however the Ontario Information and Privacy Commissioner told CTVNewsToronto.ca that Durham had not contacted them.

The Ontario Information and Privacy Commissioner told CTVNewsToronto.ca in an emailed statement that the following boards were also impacted: Thunder Bay Catholic District School Board, Lakehead District School Board, Brant Haldimand Norfolk Catholic District School Board, Near North District School Board, Northwest Catholic District School Board, Northeastern Catholic District School Board and Rainy River District School Board.

The IPC also said the Ministry of Education reported the incident to their office.

“The possibility that the sensitive personal information of students and staff has been exposed is very troubling. While public institutions like schools and school boards can outsource services to third party vendors, they cannot outsource accountability for protecting personal information,” the IPC statement read.

As for the Ottawa Catholic School Board, it has warned parents about the breach, noting that specific details are still being determined. It is in touch with PowerSchool to address the issue.

Manitoba

Around 16 Manitoba school divisions were affected by the data breach, CTVNewsWinnipeg.ca reports.

School boards include: Louis Riel, Sunrise, Portage la Prairies, River East Transcona, Division Scolaire Franco-Manitobaine, Swan Valley, Mountain View, Park West, Beautiful Plains, Brandon, Prairie Spirit, Western, Borderland, Red River Valley, Hanover and Seine River.

The school divisions noted that PowerSchool has worked with cybersecurity experts to resolve the situation.

The Maritimes

The Cape Breton-Victoria Regional Centre for Education in Nova Scotia were also included in the data breach.

The federal government is also conducting their own investigation.

The Prince Edward Island government also says the personal data of past and present students, teachers, parents, guardians and administrators may have been compromised and is working with PowerSchool to better understand the impact.

With files from CTVNewsToronto.ca’s Alex Arsenych, CTV National News’ Garrett Barry, CTVNewsCalgary.ca’s Michael Franklin and Timm Bruch.