3 GTA school boards say student info may have been exposed in 'cyber incident'

Three school boards in the Greater Toronto Area, including Canada's largest public school board, say the personal information of their students and some staff may have been exposed due to a "cyber incident."

The incident involves PowerSchool, an application used to store a range of student information and some information about school-based staff, says an email sent to parents and caregivers by Toronto District School Board's interim director of education, Stacey Zucker, on Wednesday.

The email says the application experienced a data breach between Dec. 22 to 28, 2024, and that the school board was informed about it on Tuesday. 

PowerSchool has said that the data obtained by the unauthorized user has since been deleted and no copies were posted online, Zucker's email says. 

In an email, PowerSchool spokesperson Melissa Wenzel said the company consulted third-party cyber security experts in its response and PowerSchool does not "anticipate the data being shared or made public." The company is continuing to provide service as usual, she said.

The Information and Privacy Commissioner of Ontario has been notified. 

Durham District School Board and Peel District School Board sent out emails to parents and caregivers of its students, saying they were also impacted by the data breach. 

All three boards say they are still assessing the exact information that may have been accessed or exported from the application.

The boards added that if any personal information is found to have been affected, they will let anyone impacted know as soon as possible. 

A spokesperson for the TDSB said a message about the data breach was sent out to parents Wednesday and posted to the board's website, but did not comment further. 

Expert says breach could be 'physical safety concern'

David Shipley, a cyber security expert and CEO of Beauceron Security, says it's difficult to tell what information might have been compromised, but past attacks on other school boards have accessed information on students' medical records and even school bus stops.

"Those are the things that bother me the most because this is the kind of information that, put out to the dark web, could be used by other groups, which would represent more of a physical safety concern," he said.

Shipley says PowerSchool's large customer base makes it a prime target for organized crime looking to leverage personal information.

He says the investigation into the attack will have to look at the cyber security PowerSchool had in place, saying school boards can't be expected to combat cyber criminals with the I.T. funding they get.

"If they did best practices, they're just unlucky," he said. "That's how insane the world is."