Federal privacy watchdog discontinuing investigation into student data breach
Probe into PowerSchool was launched in February, privacy commissioner says
The federal privacy watchdog says it has discontinued the investigation into a cybersecurity breach involving a student information system used across Canada, citing its satisfaction with the company's response and commitment to added security measures.
Privacy Commissioner Philippe Dufresne says the probe was launched in February after his office received a breach report from U.S.-based PowerSchool, which provides the affected software, and a complaint about the incident.
The commissioner's office says a hacker had obtained data such as names, contact information, birth dates and, in some cases, medical information and Social Insurance Numbers of current and former students, current and former educators, and parents across several provinces and territories.
It says PowerSchool took measures to contain the breach, notified affected individuals and organizations and offered credit protection, and has voluntarily committed to additional actions including strengthened monitoring and detection tools.
The commissioner's office says those steps have prompted Dufresne to discontinue the investigation into the breach, but the office will monitor PowerSchool's commitment to its strengthened security measures.
It says the decision to stop its probe won't impact ongoing investigations into the breach by provincial privacy watchdogs in Ontario and Alberta.
"I welcome PowerSchool's willingness to engage with my office to achieve a timely resolution that will result in stronger protections for the personal information of students, parents, and educators across Canada," Dufresne said in a news release Tuesday.
The Toronto District School Board, the largest school board in Canada, said in a letter to parents and caregivers in May that it had recently learned data stolen in December 2024 was not destroyed and that a "threat actor" had demanded ransom.
PowerSchool had said it paid the ransom in hopes of preventing public release of the stolen data.
"We made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve," it said in a statement in May.
PowerSchool said in a letter to the commissioner Tuesday that it will confirm any further forensic and authentication steps it will take by the end of this month, and the company will provide evidence that it has strengthened its security monitoring tools by the end of this year.
It said PowerSchool will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.