Alberta privacy watchdog reviewing PowerSchool cybersecurity breach
Posted February 12, 2025 10:57 am.
Last Updated February 12, 2025 10:59 am.
Alberta’s privacy commissioner says she is in the “beginning stages” of a review into dozens of cybersecurity breaches in the province involving a student information system used across Canada.
Diane McLeod says Alberta’s Office of the Information and Privacy Commissioner (OIPC) has received 31 breach notices from educational institutions about the December cybersecurity incident at PowerSchool, a U.S.-based third-party application used to store staff and student information.
Two Edmonton school boards were affected by the Dec. 22-28 data breach: Edmonton Catholic School Division and St. Albert Public Schools. In Calgary, Rocky View Schools and the Calgary Board of Education were affected.
“I take the privacy rights of Albertans, and in particular children, very seriously,” said McLeod in a news release Wednesday. “We are in the beginning stages of our review of these breach notices and will be working with the affected educational institutions to mitigate the risks to those affected by the breach.
RELATED: Cybersecurity experts warn parents after PowerSchool data breach
“We are reviewing the breach notices as they come in to determine the total number of Albertans affected, but it is clear that it is a significant number, including many students. I am also working with my counterparts throughout Canada to address this breach.”
Other affected Canadian school boards are in Newfoundland and Labrador, Prince Edward Island, Nova Scotia, Ontario, Manitoba, Saskatchewan and Northwest Territories.
On Tuesday, Canada’s federal privacy watchdog said he launched a formal investigation.
Information like students’ names, family names, date of birth, phone numbers, genders, grades, email address, student ID numbers and addresses were compromised. Other information that may have been accessed includes notes about allergies, medication and medical conditions, personal health numbers, physician contact information and guardian information.
The OIPC says in some cases, the personal information of educators was also mentioned in the breach notices.
PowerSchool has been notifying affected Canadians and offering them credit monitoring and identity protection services.
