Manitoba student information falls victim to data breach at U.S. company

Dozens of Manitoba school divisions have fallen victim to a data breach that has compromised student information.

PowerSchool, a web-based student management system used in many school divisions, suffered a data breach in December.

In Manitoba, 28 out of 37 school divisions are currently using or in the process of converting to PowerSchool, acting education minister Tracy Schmidt said in the legislature in October.

PowerSchool informed Louis Riel School Division in Winnipeg and Seine River School Division in Lorette, both of which use PowerSchool, of the cyberattack on Tuesday. By Wednesday, both schools released a letter to alert staff and parents of the breach.

Beautiful Plains, Mountain View, Swan Valley, Border Land, Brandon, Rolling River, Portage la Prairie, Hanover, Southwest Horizon, Sunrise and Red River Valley school divisions and the Division scolaire franco-manitobaine have all posted notifications to parents about the breach. Rolling River's notification said PowerSchool told the division "Rolling River School Division's student and staff data was not impacted by this cybersecurity incident."

"We believe that the data accessed included some specific personal information of students and the name and email address of LRSD staff who are PowerSchool users," Louis Riel School Division wrote in its letter.

The PowerSchool data breach has affected customers across Canada as well as in the U.S.

LRSD said PowerSchool has told the school division that cybersecurity experts have resolved the situation and any accessed data has now been deleted.

The letter sent by Seine River School Division said information including student names, dates of birth, home phone numbers, sibling information, gender, grades and parent names may have been exported in the data breach. 

A provincial spokesperson said in a written statement that the province is in communication with school divisions to determine the extent of the issue, and that school divisions in Manitoba are responsible for their own student information systems.

PowerSchool, a California-based provider of cloud software to over 16,000 customers in more than 90 countries, said the company became aware of the potential cybersecurity incident on Dec. 28 and has taken steps to prevent the data involved from further unauthorized access or misuse.

"The incident is contained and we do not anticipate the data being shared or made public. PowerSchool is not experiencing, nor expects to experience, any operational disruption and continues to provide services as normal to our customers," a PowerSchool spokesperson said in a written statement.

PowerSchool is used in school divisions across the country. Alberta, New Brunswick and Ontario are among the provinces reporting the cybersecurity breach at schools in their provinces.