More than 80 school boards across seven provinces and one territory say they have been impacted by the PowerSchool data breach.
The numbers give further insight into the developing scope of the breach that has impacted school boards in Canada, the U.S. and globally after the company’s software — used by schools to store student and staff data — was compromised in late December.
Last week, Global News confirmed more than 2.4 million students had been impacted at Ontario’s two biggest school boards — the Toronto District School Board and Peel District School Board.
Global News reached out to each province and territory’s education departments to determine how many had seen schools within their jurisdictions reporting use of the systems or a confirmed breach.
Their responses to date indicate just three provinces and two territories were unaffected.
According to the various officials and public statements from school boards, data breaches were seen in school boards in:
- Alberta
- Saskatchewan
- Manitoba
- Ontario
- Northwest Territories
- Nova Scotia
- Prince Edward Island
- Newfoundland and Labrador.
Quebec, New Brunswick, Nunavut, British Columbia and Yukon officials said their school boards were also not impacted.
Nunavut said in an email that its education department doesn’t use PowerSchool software, “therefore Nunavut schools were not affected by the data breach,” with Yukon and B.C. also advising they do not use the software “involved in the breach.”
Quebec said in an email “only one organization uses PowerSchool” and was not affected by the breach.
New Brunswick said it uses “seven separate PowerSchool instances, one for each district. The data breach was related to a configuration that allowed PowerSchool to remotely access servers for troubleshooting. However, this was not implemented in New Brunswick.”
Through communication with these officials, as well as visiting individual school board websites and reaching out to the various districts and divisions, Global News was also able to confirm so far that more than 75 school boards in the affected provinces have said they were impacted by data breaches.
That number is current as of Jan. 28.
Officials with the education ministries in Newfoundland and Labrador as well as Prince Edward Island confirmed all their school boards had been impacted by the breach.
In Newfoundland, that means NLSchools and Conseil scolaire francophone de Terre-Neuve et Labrador were impacted, while the Public Schools Branch and La Commission scolaire de langue française: Accueil in P.E.I. were affected.
Get breaking National news
For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen.
Saskatchewan and Nova Scotia officials told Global News just one school board in each of their provinces was impacted, with Prairie Spirit School Division and Cape Breton-Victoria Regional Centre for Education affected, respectively, while officials in the Northwest Territories said five of their school boards were affected.
Those boards are Yellowknife Education District No. 1 and the capital’s Catholic School division, as well as Beaufort Delta Division Education Council, Dehcho Divisional Educational Council, and South Slave Divisional Education Council.
Manitoba education ministry officials referred Global to each school division for information, though at least 21 school divisions have notices or confirmed to Global News they were impacted. These include Brandon School Division, Flin Flon School Division, Louis Riel School Division and Seine River School Division.
Ontario’s Ministry of Education said to contact PowerSchool, which has yet to provide a fulsome breakdown of the impacts. However, the Office of the Information and Privacy Commissioner of Ontario told Global News in an email that, as of Jan. 28, 20 school boards had contacted them about having their information accessed.
In addition to the TDSB and PDSB, the Durham District School Board, York Region District School Board, London District Catholic School Board and Ottawa Catholic School Board were all impacted.
Alberta officials also did not provide details of how many school boards there were impacted, but school boards there have posted notices on their websites, including the Calgary Board of Education, Edmonton Catholic School Division, Red Deer Public Schools, Medicine Hat Catholic Board of Education and Medicine Hat Public School Division.
The number of students, staff and parents impacted are so far only known from some school boards that have communicated those numbers to the public.
Of those that have confirmed being impacted, more than 2.46 million students have been affected in the Toronto and Peel school boards.
Nova Scotia’s government confirmed 35,000 current and former students were impacted.
The number of staff impacted is not as well known, though Peel said 18,760 staff members were affected with 3,200 employees at Cape Breton-Victoria Regional Centre for Education in Nova Scotia impacted.
How many schools impacted, however, could change as investigations are ongoing into the situation.
Some schools that previously notified parents, students and staff early this month about the data breach later advised that PowerSchool or internal investigations had determined no data had been accessed. Others confirmed they had determined data had been impacted and how far back the data stretched.
For example, Peel District School Board said individuals impacted may include students who attended as far back as 1965, while Edmonton Catholic Schools said students from 2009 and onwards were affected.
The federal privacy commissioner says he is “concerned” about the data breach and has been in touch with PowerSchool about the incident to determine next steps.
Ontario’s privacy commissioner is investigating, while Alberta’s said it is reviewing the data breaches it received as part of its breach review process.
PowerSchool says it continues to investigate the incident and has engaged various credit monitoring services, including TransUnion, to offer two years of complimentary credit monitoring services for adults affected regardless of whether their social insurance or social security numbers were accessed.
They have also offered identity protection services “as applicable” for all students and educators.
On Monday, the company said it is filing regulatory notifications with the offices of U.S. attorneys general across applicable jurisdictions on behalf of impacted customers, and have started notifying Canadian regulators as well.
Last week, an Alberta law firm also launched a class-action lawsuit against the company though added there’s “no urgent call to action” at this time, as the lawsuit will still need to be certified.
Have you received a notice that your school board or your family’s personal data was impacted in the PowerSchool breach in Canada? Let us know by emailing [email protected] or using the contact form below.
