N.L. privacy commissioner investigating government response to school cyberattack
Kerry Hatfield says she wants to make sure province has taken steps to prevent another breach
The province's information and privacy commissioner is investigating a security breach that saw hackers steal the private information of nearly 300,000 current and former students and teachers in Newfoundland and Labrador.
In a news release sent Friday afternoon, Privacy Commissioner Kerry Hatfield said part of that investigation will look at whether the Education Department has taken enough action in the wake of the PowerSchool attack to make sure it doesn't happen again.
"Before launching this investigation I felt it was appropriate to give the department sufficient time to assess the impact of the breach, notify those who were impacted, and take steps to adjust its policies and practices," she said in the release. "It has now had ample opportunity to do so."
The late-December cyberattack struck PowerSchool, the data management software used by the English, French and Indigenous school systems — along with other school districts across North America.
According to the Education Department, on Dec. 28 hackers stole the information of approximately 271,000 students and 14,400 teachers across Newfoundland and Labrador's English, French, and Indigenous school systems.
The stolen data includes contact information, date of birth, MCP numbers, medical alert information, custodial alert information, some social insurance numbers and other related information. Some of that data dates back to 1995.
The department said about 75 per cent of the stolen student data belongs to people who are no longer in the K-12 system.
The company offered two years of free identity and credit monitoring to any of the victims, and has since hired Experian and TransUnion to provide those services.
"The purpose of my investigation is not only to assess whether the department has responded adequately to the breach, but also to ensure that measures taken by the department to prevent future occurrences of this nature are sufficient," said Hatfield.
"People have a right to expect that when a public body collects their sensitive personal information that it will do so in accordance with the law."
Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Click here to visit our landing page.