Educational institutions across several provinces have been impacted by a cybersecurity incident affecting a software platform that manages student data throughout North America.
School districts in Toronto, Peel, and Durham, Ontario released similar statements regarding a security breach involving PowerSchool, a third-party platform that also maintains certain school employee information.
The announcements indicate that PowerSchool informed various school boards across Ontario and other regions on Tuesday about a data compromise that occurred between December 22 and 28.
Representatives from Ontario, Alberta, Newfoundland and Labrador, and Nova Scotia confirm they are collaborating with PowerSchool to assess the breach’s impact.
PowerSchool, which operates as a cloud software provider based in the United States, has released a statement confirming it has implemented all necessary measures to stop further unauthorized data access or misuse.
The organization states the incident has been contained and they don’t expect the compromised information to be distributed or published publicly.
The affected Ontario educational boards have alerted the Information and Privacy Commissioner of Ontario about the security breach.
“We understand this information may raise concerns, but we want to assure you that we’re taking all possible steps to gather more details from PowerSchool about the incident and will communicate updates accordingly,” stated Stacey Zucker, interim education director at the Toronto District School Board, in a Wednesday message to families.
Edmonton Catholic Schools made public a communication received from PowerSchool.
“Our investigation has revealed that unauthorized access to certain PowerSchool Student Information System customer information occurred through a compromised credential, and we must inform you that your data was accessed,” the communication stated.
Newfoundland and Labrador’s government also announced the PowerSchool data breach, noting the platform’s use throughout their K-12 education system. They indicated that several government departments are coordinating to determine future actions.
In Nova Scotia, the Cape Breton-Victoria Regional Centre for Education confirmed its involvement in the breach.
“Provincial authorities are working alongside the vendor to evaluate the breach’s scope,” according to their statement. “While complete implications remain unclear, there’s no evidence suggesting PowerSchool systems in other education centers were compromised.”
The statement noted that while PowerSchool claims the breach is contained, Nova Scotia is conducting an independent investigation for verification.
PowerSchool confirmed that regular services continue for customers as they proceed with their investigation into the data breach.
“We maintain an unwavering commitment to protecting student data privacy and executing our responsibilities as data processors with utmost seriousness,” the company stated.
