TorontoPrivacy watchdogs in Ontario and Alberta have issued their findings after investigating a mass data breach of a student information system used across Canada in 2024, concluding that school boards lacked adequate breach response plans, among other issues. About 5.2 million Canadians were affected by cyberattack on PowerSchool in December 2024, according to reportRianna Lim · The Canadian Press · Posted: Nov 19, 2025 9:11 AM EST | Last Updated: 2 hours agoListen to this articleEstimated 3 minutesThe audio version of this article is generated by text-to-speech, a technology based on artificial intelligence.Both provinces had similar findings, including that some or all school boards lacked adequate breach response plans or protocols, failed to include certain privacy and security provisions in their contracts with PowerSchool and lacked policies to oversee PowerSchool’s safeguards. (PabloLagarto / Shutterstock)Privacy watchdogs in Ontario and Alberta issued their findings Tuesday after investigating a mass data breach of a student information system used across Canada, concluding that school boards lacked adequate breach response plans, among other issues.Ontario’s privacy commissioner says PowerSchool, a software and storage company for school systems in the U.S. and Canada, was a victim of a cyberattack and ransom threat in December 2024 that compromised the data of current and former students, parents and staff.Ontario’s watchdog says about 5.2 million Canadians were affected by the cyberattack, and while PowerSchool paid a ransom, the threat actor also demanded ransom payments from school boards, including those in Toronto and Peel Region.Cyberattacks can take entire school networks out. It’s time to pay more attention to them, experts sayCyberattack affecting school boards across Canada may involve decades of data. What can families do?Though Ontario and Alberta launched separate investigations, both had common findings, including that some or all school boards lacked adequate breach response plans or protocols, failed to include certain privacy and security provisions in their contracts with PowerSchool and lacked policies to oversee PowerSchool’s safeguards.The provincial privacy commissioners made recommendations in their reports, including that the boards review their agreements with PowerSchool, implement monitoring systems and ensure adequate breach policies are in place.The findings come after a 19-year-old Massachusetts man was sentenced to four years in prison last month after pleading guilty to the cyber extortion of two companies, including PowerSchool.WATCH | PowerSchool targeted in cyberattack:Cyberattack hits hundreds of schools across CanadaParents and caregivers across Canada were informed of a data breach involving software named PowerSchool, which is used across North America to store student information.Court documents say a company the man targeted received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.PowerSchool said at the time of the sentencing that it remained “focused on supporting our school partners and safeguarding student, family and educator data.”School boards hit with ransom demands linked to PowerSchool cyberattackIn February, Canada’s federal privacy watchdog launched an investigation into the data breach.Privacy commissioner Philippe Dufresne discontinued that investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.
Ontario, Alberta school boards caught unprepared in mass student data breach: provincial watchdogs
