Various school boards across the Greater Toronto Area experienced a “cyber incident” after an application they use to store student and limited staff information was exposed to a data breach over the holiday break.
The Toronto District School Board (TDSB) updated parents and guardians about a data breach experienced by PowerSchool, which occurred between Dec. 22 and 28, 2024. A spokesperson for PowerSchool confirmed to CTV News Toronto that they were aware of a “potential cybersecurity incident” on Dec. 28, involving one of their community-focused customer portals, PowerSource.
PowerSchool is used by several school boards across the continent, the TDSB says. That fact is made evident as both Durham District School Board (DDSB) and Peel District School Board (PDSB) say they have also been impacted by the data breach.
“Our cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational,” the TDSB says.
The impacted school boards say they are conducting a thorough investigation alongside PowerSchool to “understand the nature of the incident” and determine what personal information may have been impacted.
“At this point in time, we are still assessing the exact information that may have been accessed or exported from the application,” Stacey Zucker, TDSB’s Interim Director of Education, wrote in her email to parents.
The school boards did say they have received confirmation that whatever data the unauthorized user accessed has been deleted and that no copies of that information were shared online.
That said, if they determine any personal information was impacted by the cyber incident, the school boards say they will alert families as soon as possible.
“We have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse,” a PowerSchool spokesperson said in an emailed statement.
“The incident is contained and we do not anticipate the data being shared or made public.”
PowerSchool adds that it has engaged its cybersecurity response protocols and mobilized a cross-functional response team, which includes third-party cybersecurity experts and senior leadership.
The TDSB, the DDSB and the PDSB say they have contacted the Information and Privacy Commissioner of Ontario “out of an abundance of caution.” CTV News Toronto contacted the commissioner for comment but did not immediately receive a response.
“We know this news may be concerning, but please know that we are doing everything possible to learn more from PowerSchool about what occurred and will share that information with you,” the notice to parents reads.
It is unclear at this time how many school boards are currently impacted by PowerSchool’s data breach.