41 Alberta schools under investigation regarding PowerSchool breach: Privacy commissioner

The Office of the Information and Privacy Commissioner says there are 41 investigations into PowerSchool clients affected by a data breach.

The Office of the Information and Privacy Commissioner (OIPC) of Alberta said multiple Alberta schools have received extortion attempts stemming from the PowerSchool data breach.

• The information you need to know, sent directly to you: Download the CTV News App

Thirty-one schools were impacted by the December cybersecurity attack of the U.S.-based school administration system, which affected schools across Canada and the U.S.

Compromised data included students’ names, phone numbers, birth dates and gender, as well as information on medical information and guardian information.

The OIPC said PowerSchool notified it earlier this month that a threat actor had reached out to multiple Alberta schools to try and extort them using the stolen data.

“Our office has launched a number of investigations as a result of the PowerSchool incident,” said Information and Privacy Commissioner Diane McLeod. “This work is ongoing and we will take this new information into consideration throughout our investigative work.

“The violation of children’s privacy is a significant concern for us, and we are working on a number of fronts to protect children from harms associated with the use of technologies.”

• PowerSchool offering identity protection to Edmonton-area schools after breach
• ‘Threat actor’ attempted to extort school boards after PowerSchool breach: CBE

On Wednesday, a 19-year-old university student in Massachusetts pleaded guilty to stealing private data from two U.S. educational companies and extorting it for ransom. While PowerSchool was not named in the court filings, a source familiar with the case confirmed the company was involved to The Associated Press.

The OIPC said, as of Wednesday, there were 41 investigations into PowerSchool clients who were affected by the breach, looking into whether those institutions met obligations under privacy laws in connection with the breach.

Albertans are being warned to be careful in wake of the cybersecurity attack, especially of any unexpected or unsolicited text messages or emails relating to PowerSchool.

“While the new information appears to indicate that hackers are targeting educational institutions for extortion, it is not uncommon for hackers to target individuals whose personal information was compromised during an incident,” McLeod said.

“To this end, we advise Albertans to be vigilant in regard to potential phishing attacks by hackers who may use personal information from the PowerSchool incident.”

More information about phishing and cybersecurity can be found on the OIPC website.

With files from The Associated Press