Education technology software company PowerSchool has committed to enhancing its security measures after a major cyberattack that leaked the information of Canadian students, parents, and educators.
Information leaked in the December 2024 cyberattack included names, contact information, and dates of birth. The hacker also gained access to the medical information and Social Insurance Numbers of some current and former students, current and former educators, and parents across several provinces and territories through a contractor’s credentials.
PowerSchool had executed measures to limit the attack and informed the impacted individuals and organizations. It also offered credit protection and committed to adopting improved monitoring and detection tools.
The company informed the Office of the Privacy Commissioner of Canada of the breach on January 27, 2025. It consulted with the office on the appropriate actions.
In its commitment letter, PowerSchool said that by December 31, it would present evidence that it had bolstered its monitoring and detection tools, as well as proof that the tools could detect patterns of irregular activity. Moreover, the company was required to prove that it had reviewed and readjusted system access privileges in line with security best practices and operational requirements.
Privacy Commissioner of Canada Philippe Dufresne said that he was suspending the PowerSchool investigation initiated in February given the steps being taken by the company.
Nonetheless, he confirmed that he would monitor PowerSchool’s full compliance with its commitments. Provincial Information and Privacy Commissioners in Ontario and Alberta have continued with their investigations from the perspective of school boards and schools subject to their respective privacy laws.
“I welcome PowerSchool’s willingness to engage with my office to achieve a timely resolution that will result in stronger protections for the personal information of students, parents, and educators across Canada,” Dufresne said in a statement. “Federal privacy law requires that organizations protect personal information with security safeguards appropriate to the sensitivity of the information. This is particularly important when dealing with children’s personal information.”
PowerSchool serves several Canadian school boards and schools.