Personal student information that may have been exposed during a cyber security breach of an online platform used by Toronto District School Board (TDSB) is extensive and goes back decades.
On Monday, the TSDB provided more details about the cyber incident reported earlier this month by PowerSchool, a platform used to store student information.
“While our investigation into the incident continues, we have now confirmed the types of personal information stored in PowerSchool’s Student Information System that may have been accessed and acquired by an unauthorized user,” TDSB interim director of education Stacey Zucker said in a notice to parents.
PowerSchool has told the TDSB it received confirmation the data acquired by an unauthorized user during the cyber incident was deleted and was not posted online.
For students who attended the school board between September 1, 2017 and December 28, 2024, the following information was stored and potentially breached:
- First, Middle & Last Names
- Date of Birth
- Gender
- Health Card Number
- Grade Level and School Information
- Start/End Date as a Student
- Ontario Education Number
- EQAO Accommodation Information
- Medical Information (ie. allergies, conditions, injuries)
- Home Addresses
- Home Phone Numbers
- TDSB Student Number
- TDSB Email Address
- First Nations, Métis, Inuit Information
- Residency Status
- Principal/Vice Principal Notes (including discipline notes)
Contact information for those students’ parents and guardians was also stored in PowerSchool, the board said, including home addresses and phone numbers.
The TDSB said it also stored historical student information in PowerSchool so it could respond to requests for former student records.
Because of that, significant data about students who attended the board as far back as 1985 may have also been breached.
For students who attended the TDSB between September 3, 1985 and August 31, 2017, the following information was stored on the PowerSchool platform:
- First, Middle & Last Names
- Date of Birth
- Gender
- Health Card Number
- Ontario Education Number
- Home Addresses
- Home Phone Numbers
- TDSB Student Number
- TDSB Email Address
- First Nations, Métis, Inuit Information
In a separate memo to staff, the TDSB also said personal information about teachers, vice-principals, principals, classroom support staff and other employees who worked for the board as long ago as 2006 was impacted.
The board said it has reported the incident to the Office of the Information and Privacy Commissioner of Ontario, which has opened an investigation file.
The “TDSB continues to take this incident very seriously, and is working with PowerSchool to ensure an incident like this does not happen again in the future,” Zucker wrote.
The cyber incident, which took place between Dec. 22 and Dec. 28, impacted school boards across Canada, as well as others in the United States.
