Ottawa Catholic School Board advises parents of cyber incident involving student information system

Sacred Heart Catholic High School in Ottawa is seen in this file image. (CTV News Ottawa)

The Ottawa Catholic School Board is advising parents and guardians about a cyber incident involving PowerSchool, the student information system that manages student demographics, class information and school-based staff information.

In a letter to parents, Director of Education Thomas D'Amico said the board was informed by PowerSchool on Tuesday that they were investigating a potential data breach before Christmas.

"However, it wasn't until the evening of Wednesday, January 8, 2025, that PowerSchool confirmed the OCDB data may have been impacted," D'Amico said. "This was not a result of any security issue on the part of the OCSB."

PowerSchool has identified that unauthorized access to its system occurred between Dec. 19 and Dec. 23, 2024, and involved "limited student and staff data."

"PowerSchool has assured us that the breach has been contained, and the accessed data has been deleted without being shared publicly," D'Amico said, adding PowerSchool is "confident" no data has been exposed publicly.

The Ottawa Catholic School Board's cybersecurity team activated its response plan after being notified of the issue.

"We immediately began working with PowerSchool to assess the situation and ensure our systems remain secure," D'Amico said.

The head of the Catholic school board says PowerSchool has implemented enhanced security measures, including stricter access controls.

"OCSB continues to monitor the situation closely and work with PowerSchool to ensure the safety and security of all data," D'Amico said, adding the board will notify parents and guardians if any "next steps" are identified.

"We understand that situations like this can be concerning. Please know that the safety and security of our students, staff, and their information is always our top priority. We are committed to transparency and will provide updates as more information becomes available."

The Ottawa-Carleton District School Board says it has not been impacted by the cyber incident involving PowerSchool.

Several school boards in the Greater Toronto Area notified parents about the "cyber incident" involving the PowerSchool Application.

A PowerSchool spokesperson told CTV News Toronto that the tables that were subject of the breach primarily include contact information, like names and addresses for families and educators.

“For a certain subset of customers, these tables may also include Social Security Number (SSN), other Personally Identifiable Information (PII), and limited medical and grade information,” the statement reads.

Mishka McCowan, PowerSource's Chief Information Security officer, said not all school boards log sensitive information like Social Insurance Numbers into PowerSource, with that kind of data logged varying school board-by-school board.

McCowan told a technical briefing that the unauthorized access was through compromises credentials on PowerSource.

With files from CTV News Toronto's Alex Arsenych