Canada's privacy commissioner said his office has launched a formal investigation into the data breach of an online platform used by school boards — including the Toronto District School Board (TDSB) — to store information on students.
The cyber breach of PowerSchool took place between Dec. 22 and Dec. 28, and impacted school boards across Canada, as well as others in the United States.
Personal student information going back decades, as well as information about teachers, vice-principals, principals, classroom support staff and other employees who worked for the board may have been accessed in the breach, the TDSB told parents in January.
Privacy Commissioner Philippe Dufresne said Tuesday that his office is working to ensure PowerSchool is taking appropriate steps to respond to the breach.
"My immediate focus is on ensuring that the company is taking the necessary steps to address the issue and protect Canadians’ personal information, notably breach containment and measures to reduce risks to those affected, as well as actions to prevent future breaches," Dufresne said.
The privacy commissioner said his office has been advised by PowerSchool that affected people are being notified, and that the company is offering credit monitoring and identity protection services.
He said his office also remains in contact with provincial privacy counterparts on the situation.
"With a threat environment that is continuously evolving, prioritizing information security is essential and requires constant attention, particularly when dealing with children’s personal information."
PowerSchool reported the breach in early January, after its systems were accessed over the Christmas holidays when schools were closed.
At the time, the TDSB sent a note to parents assuring them that the information that was accessed had been deleted.
"PowerSchool has informed us that it has received confirmation that the data accessed by an unauthorized user has been deleted and that no copies of this data were posted online," a board official said at the time.
