Alberta privacy commissioner investigating PowerSchool data breaches
Office has received 31 notices of breaches from Alberta schools so far
Alberta's privacy watchdog is investigating more than 30 data breaches from Alberta schools stemming from the PowerSchool cyberattack, the provincial government said in a news release Wednesday.
PowerSchool, a cloud-based software platform used in K-12 education, was hit by a cyberattack in late December that accessed data held by some North American schools, including in Alberta. The company started issuing notices last month to individuals whose information was breached.
The Office of the Information and Privacy Commissioner (OIPC) has started reviewing the 31 breach notices it has received so far regarding unauthorized access to students' personal information. In some cases, teachers' personal information was also accessed.
The office will work with affected schools to reduce the potential risk posed to those whose information was exposed, Information and Privacy Commissioner Diane McLeod said in the release.
A "significant number" of Albertans were affected, including many students, McLeod said. Her office is examining notices as they come in, to figure out exactly how many people in Alberta were affected.
Also this week, federal Privacy Commissioner Philippe Dufresne said his office has launched its own investigation into the cybersecurity breach at PowerSchool.
McLeod, who works independently from government, is also working with her counterparts across Canada to address the breach, she added.
PowerSchool learned of the data breach on Dec. 28, the company says on its website. It occurred through PowerSource, one of its "community-focused customer support portals," and accessed various forms of personal and medical information.
One of the notices the OIPC received involved students' names, phone numbers, birth dates, genders, grades, school-issued email addresses, and student identification numbers.
Health information that was accessed included medical conditions, allergies and medications, personal health numbers, physician contact information and guardian information, the news release said.
The office has received information that suggests PowerSchool is offering credit monitoring and identity theft protection for people impacted by the breach, the release said, adding that people should contact PowerSchool for information about that.
Anyone who received notices should direct their questions to the school that sent them the notice, the release said.
The OIPC is directing anyone with questions regarding their rights under Alberta's privacy laws to its website.