Toronto, January 24, 2025 – A significant data breach involving PowerSchool has impacted more than 2.4 million students across Canada, with the number expected to rise as school boards continue to assess the damage. The breach was first reported by Global News, which indicated that 1.49 million students from the Toronto District School Board (TDSB) were affected.
The Peel District School Board (PDSB) confirmed that 943,082 students and 18,760 staff members were impacted, although the staff figure is lower due to individuals being assigned to multiple schools. Additionally, the Durham District School Board reported that 284,000 records were affected, but did not specify the breakdown of students and staff.
According to a report by BleepingComputer, the breach may involve the data of over 62 million students and 9.5 million teachers across North America. While Global News has not independently verified these figures, the numbers reported by TDSB and PDSB align closely with those in the BleepingComputer report.
School districts in at least six provinces have been affected, though Nunavut schools are confirmed to be safe. The Calgary Board of Education is still awaiting confirmation from PowerSchool regarding the number of impacted individuals but has stated that no social insurance numbers (SINs) were accessed.
Sandy Boucher, a cybersecurity expert, emphasized the gravity of the situation, stating that although students may not have to worry about credit card or bank account information being accessed, the data that has been compromised could still be used for social engineering attacks. He warned that even without a SIN, the information could facilitate identity theft or financial fraud.
Canada’s privacy commissioner is in communication with PowerSchool, and Ontario’s privacy commissioner is investigating the breach. Technology analyst Carmi Levy noted that public institutions are increasingly targeted by cybercriminals and highlighted the potential consequences of even minimal personal information being exposed.
In response to the breach, Calgary law firm Cuming and Gillespie has filed a lawsuit against PowerSchool, claiming that the incident has caused anxiety and mistrust among those affected. The firm indicated that more information will be provided on their website regarding the lawsuit and how individuals can participate if it is certified.
The situation continues to evolve, with experts advising individuals to monitor their personal information and take proactive measures to protect themselves from potential identity theft and fraud.
