Canada’s privacy watchdog to investigate PowerSchool student information data breach​on February 11, 2025 at 7:48 pm

The federal privacy watchdog says he has launched a formal investigation into a cybersecurity breach involving a student information system used across Canada.

Privacy commissioner Philippe Dufresne says the probe was launched after his office received a breach report from U.S.-based PowerSchool, which provides the affected software, and a complaint about the incident.

PowerSchool has told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere across North America that it experienced a data breach between Dec. 22 and 28.

Rocky View Schools, which is among the boards whose data was part of the breach, shared additional details on its website on Monday about how to access credit monitoring and identity protection services.

“Records of current students and staff have been accessed as well as former students and staff dating back to 2012,” the school board said.

Student information affected includes ID numbers and passwords, personal details, addresses and phone numbers, while emergency contact, medical and parental custody information may also have been breached, the board added. Staff information leaked include names, contact information, work-related data and expired passwords.

“No personal documents or photos were accessed,” said Rocky View Schools in its statement. “Personal documents such as birth certificates and drivers’ licences are uploaded into the SchoolEngage system and not PowerSchool.”

Banking information and social insurance numbers are also stored in a different system unrelated to PowerSchool, RVS added.

The Calgary Board of Education is also among organizations affected. It said last month full names, student IDs, home addresses, phone numbers and, in some cases, medical data of students and staff were among the information affected. The CBE has also offered credit monitoring and identity protection services.

St. Albert Public Schools and Edmonton Catholic Schools said their schools were impacted by the attack, while the Calgary Catholic School District says its schools weren’t affected.

Dufresne says his “immediate focus” is to ensure that PowerSchool is taking measures to reduce the risk to those affected by the breach and prevent this from happening again.

With files from Postmedia