US EditionSchool boards caught unprepared in mass student data breach: provincial watchdogs
Investigations revealed millions of Canadians affected with school boards lacking breach response plans and proper oversight of PowerSchool’s cybersecurity safeguards.
- On Tuesday, Patricia Kosseim and Diane McLeod found school boards lacked adequate breach response plans after the PowerSchool cyberattack affecting about 5.2 million Canadians.
- Between Dec. 22 and 28, 2024, the attacker used compromised PowerSource credentials tied to a former subcontractor, prompting PowerSchool to pay ransom and triggering another demand on May 4, 2025.
- Roughly 3.86 million Ontarians had personal information exposed, and twenty school boards and the Ontario Ministry of Education reported incidents with sensitive records dating back to 1985.
- The commissioners recommended that school boards review contracts with PowerSchool, limit remote access due to an "always on" feature, and ensure compliance within six months while PowerSchool provides an independent security assessment by March 2026.
- The reports come after last month's sentencing of a Massachusetts man, court documents citing a US$2.85 million bitcoin ransom demand, and the federal privacy watchdog discontinuing its investigation in July.
34 Articles
34 Articles
CBE has done enough to combat data breach, still will take recommendations into consideration
The Office of the Information and Privacy Commissioner (OIPC) of Alberta investigation has officially released their findings after investigating the late 2024 PowerSchool information breach. Earlier this year, the organization told the CBE they’ve done enough to manage the leak.
Privacy commissioner calls for better cybersecurity in Alberta schools after big breach
After a breach of PowerSchool last year exposed the personal information of students in schools around Alberta, across Canada and the U.S., a new report from the province's privacy commissioner has found where some security measures fell short.
TDSB and other Ontario school boards slammed over security failures that compromised millions of student records in cyberattack
Ontario privacy commissioner says “institutions did not have reasonable measures” to prevent 2024 incident that targeted the software used by boards.
GTA school boards did not have ‘reasonable measures’ to stave off student data breach: privacy commissioner
An investigation determined the Greater Toronto Area school boards impacted by a cyberattack late last year did not have 'reasonable measures' to prevent unwanted access to personal information they collected and lacked 'necessary oversight' to monitor PowerSchool’s obligations of its obligations.
Coverage Details
Bias Distribution
- 69% of the sources lean Left
Factuality
To view factuality data please Upgrade to Premium
