School boards caught unprepared in mass student data breach: provincial watchdogs
Advertisement
Read this article for free:
or
Already have an account? Log in here »
To continue reading, please subscribe:
Digital Subscription
One year of digital access for only $205*
- Enjoy unlimited reading on winnipegfreepress.com
- Read the E-Edition, our digital replica newspaper
- Access News Break, our award-winning app
- Play interactive puzzles
*First annual payment billed as $205.00 + GST for one year. This annual subscription will automatically renew at $233.00 + GST every 52 weeks (10% off the regular annual price of $259.35). Offer available to new and qualified returning subscribers only. Cancel any time.
To continue reading, please subscribe:
Add Free Press access to your Brandon Sun subscription for only an additional
$1 for the first 4 weeks*
- Enjoy unlimited reading on winnipegfreepress.com
- Read the E-Edition, our digital replica newspaper
- Access News Break, our award-winning app
- Play interactive puzzles
*Your next Brandon Sun subscription payment will increase by $1.00 and you will be charged $17.95 plus GST for four weeks. After four weeks, your payment will increase to $24.95 plus GST every four weeks.
Read unlimited articles for free today:
or
Already have an account? Log in here »
Hey there, time traveller!
This article was published 18/11/2025 (302 days ago), so information in it may no longer be current.
Privacy watchdogs in Ontario and Alberta issued their findings Tuesday after investigating a mass data breach of a student information system used across Canada, concluding that school boards lacked adequate breach response plans, among other issues.
Ontario’s privacy commissioner says PowerSchool, a software and storage company for school systems in the U.S. and Canada, was a victim of a cyberattack and ransom threat in December 2024 that compromised the data of current and former students, parents and staff.
Ontario’s watchdog says about 5.2 million Canadians were affected by the cyberattack, and while PowerSchool paid a ransom, the threat actor also demanded ransom payments from school boards, including those in Toronto and Peel Region.
Though Ontario and Alberta launched separate investigations, both had common findings, including that some or all school boards lacked adequate breach response plans or protocols, failed to include certain privacy and security provisions in their contracts with PowerSchool and lacked policies to oversee PowerSchool’s safeguards.
The provincial privacy commissioners made recommendations in their reports, including that the boards review their agreements with PowerSchool, implement monitoring systems and ensure adequate breach policies are in place.
The findings come after a 19-year-old Massachusetts man was sentenced to four years in prison last month after pleading guilty to the cyber extortion of two companies, including PowerSchool.
Court documents say a company the man targeted received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.
PowerSchool said at the time of the sentencing that it remained “focused on supporting our school partners and safeguarding student, family and educator data.”
In February, Canada’s federal privacy watchdog launched an investigation into the data breach.
Privacy commissioner Philippe Dufresne discontinued that investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.
PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.
This report by The Canadian Press was first published Nov. 18, 2025.
