The Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner of Alberta have released a joint investigation report into a cyberattack on PowerSchool‘s systems. The regulators conclude that PowerSchool and several Ontario school boards did not have adequate safeguards and oversight in place for the personal information of students and staff that was compromised in the incident.
A threat actor obtained compromised credentials and used them to access PowerSchool’s student information system and the associated PowerSource customer support portal between 22 and 28 December 2024. The attacker exfiltrated data that included names and contact details of current and former students, education records, and other personal information. The specific data elements varied by school board and system.
The commissioners state that PowerSchool was acting as a service provider under provincial privacy laws and that it did not implement sufficient security controls given the sensitivity of the data. The report cites weaknesses in areas such as network segmentation, the management of remote access accounts, and the use of multi factor authentication for privileged access. It also notes gaps in monitoring and logging that affected the company’s ability to detect and respond to the intrusion.
The investigation examined how school boards had structured their contracts and oversight of PowerSchool. The commissioners found that some Ontario boards relied on contracts that lacked detailed security and privacy provisions. These included clear requirements for technical safeguards, incident reporting timelines, and audit rights. The report concludes that these boards did not take reasonable steps to ensure that their service provider protected student information in accordance with legal obligations.
School boards including the Toronto District School Board have issued notices acknowledging that the incident stemmed from a breach at PowerSchool. Public statements indicate that boards have notified affected individuals and are cooperating with regulators. They are also reviewing their contracts and oversight practices for third party vendors handling student data.
Sources: IPC Ontario; Toronto District School Board; Global News.
—
By the ID Tech Editorial Team
