Privacy czar concerned about students’ personal info as scope of data breach revealed

The federal privacy watchdog says he’s “concerned” about a cybersecurity breach involving a student information system used across Canada, as the country’s largest school board revealed the scope of the data that may have been stolen last month.

The Toronto District School Board told parents and guardians in an email Monday that its students’ birthdays, addresses, health card numbers, emergency contacts and some medical information stored since September 2017 may have been included in the data breach involving the PowerSchool platform.

Certain “historical student information” – including health card numbers and home addresses – from September 1985 through August 2017 was also compromised, the school board said.

Privacy commissioner Philippe Dufresne said in a statement on Monday that his office is in touch with the U.S.-based PowerSchool, which provides the affected software to schools across North America.

“I am concerned about the potential impact that an incident such as this one may have on the personal information of students across the country,” he said.

Earlier this month, PowerSchool told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere that it had experienced a data breach between Dec. 22 and 28.

At the time, the company said the cybersecurity incident was “contained” and that it had taken steps to prevent further unauthorized access or misuse of the affected data.

The Toronto District School Board said Monday that PowerSchool has “received confirmation that the data acquired by the unauthorized user was deleted” and that the information was not posted online.

“To be clear, TDSB does not store any social insurance numbers, financial or banking information in the PowerSchool Student Information System, so that information was not affected in any way,” it said in the email to parents.

Nova Scotia’s Education Department has previously said that the breach could have a financial impact on some former and current teachers and staff, since some social insurance numbers collected before 2010 were included in the stolen data.

The federal privacy czar said his office is seeking more information about the breach and will also inform PowerSchool about reporting requirements under Canada’s privacy legislation.

“This will allow us to convey our expectations to the company regarding their response to the breach and to determine next steps,” Dufresne said.

“Championing the privacy rights of children is one of my strategic priorities as children’s personal information is particularly sensitive.”

PowerSchool has said it is providing services to customers as usual as it continues to investigate.

This report by The Canadian Press was first published Jan. 20, 2025.

Sonja Puzic, The Canadian Press