Report released on school cyber attack
The Ontario information and privacy commissioner has released a report following a massive privacy breach through technology used by many schools in the province.
The PowerSchool incident, which affected millions of Canadians across the country, saw personal information stolen in December of 2024. The company admitted to paying a ransom to recover the information
The key findings of the investigation:
- Failed to include certain privacy and security-related provisions in their contractual agreements with PowerSchool to ensure that the educational bodies meet the requirements of applicable provincial public sector privacy law.
- Lacked policies and procedures to effectively monitor and oversee PowerSchool’s technical and security safeguards to ensure the company complied with its contractual terms and conditions, including in respect of user access privileges for remote support personnel and the use of multi-factor authentication.
- Failed to limit remote access to their student information systems by PowerSchool support personnel for only as long as necessary to address specific technical issues.
- Lacked adequate breach response plans or protocols.
Among the recommendations made in the report:
- Review and, as needed, renegotiate agreements with PowerSchool to include the recommended privacy and security related provisions to ensure that the educational bodies meet the requirements of applicable provincial public sector privacy law.
- Implement effective monitoring and oversight over PowerSchool’s technical and security safeguards to ensure they are compliant with applicable provincial public sector privacy law and leading industry standards, including, by conducting a privacy impact assessment of their student information systems.
- Limit remote access to their student information systems on an as-needed basis only.
- Ensure they have adequate policies and procedures to respond to breaches in the future.
The Keewatin Patricia District School Board says we take the IPC’s findings and recommendations seriously. Since the incident, we have worked with PowerSchool to strengthen security measures and will continue to ensure our technology partners meet the highest standards for the privacy and data protection of students and staff.
We are updating our agreements, improving oversight, implementing new response policies and procedures, and enhancing our privacy practices in line with the IPC’s recommendations. We are also collaborating with other Ontario school boards to ensure a coordinated approach to vendor security.
“Protecting the personal information of our students, families, and staff remains our top priority,” said Christy Radbourne, Director of Education at KPDSB. We thank the IPC for its guidance and will report on our progress as we implement these important changes.“
