Canada’s Privacy Commissioner, Philippe Dufresne, has initiated a formal investigation into a massive cybersecurity breach that exposed the personal information of millions of K-12 students nationwide.
The investigation, launched under the Personal Information Protection and Electronic Documents Act (PIPEDA), comes in response to a formal complaint and breach report from the U.S.-based PowerSchool, a cloud software provider.
Discovered in late December 2024, the unauthorized data breach involved PowerSchool’s Student Information System (SIS) used by Canadian school boards for student information management.
Compromised data includes sensitive information such as addresses, medical details, grades, and disciplinary notes. Additionally, social insurance numbers of approximately 35,951 educators and staff were exposed.
Read: Canada Announces New National Cyber Security Strategy
Addressing the Widespread Data Breach
The full extent of the breach is yet to be determined, with at least 87 school boards across Canada confirmed to have been affected. The Toronto District School Board reported that approximately 1.49 million students have been affected by the data breach.
Affected regions include Newfoundland and Labrador, Nova Scotia, Ontario, Alberta, Manitoba, Prince Edward Island, and the Northwest Territories. For Alberta alone, the privacy commissioner reportedly received 31 breach notices from schools across the province.
Dufresne noted, “My immediate focus is on ensuring that the company is taking the necessary steps to address the issue and protect Canadian’s personal information, notably breach containment and measures to reduce risks to those affected, as well as actions to prevent future breaches.”
In response to the breach, PowerSchool offered the affected students and educators two years of complimentary identity protection services, provided by Experian, and credit monitoring services facilitated by TransUnion.
The data breach highlights the critical need for stronger cybersecurity measures in Canada’s educational institutions.
More on Cybersecurity:
TRS-24 Panel: Cybersecurity Under the Spotlight
TELUS Bolsters Cybersecurity Arsenal With Vumetric Acquisition
Protecting Canadians in the Age of AI: Canada Launches National Safety Institute
