Some Canadian school boards say they’ve been the target of ransom attempts in relation to the massive data breach of PowerSchool, which saw millions of current and former students across the country impacted.
In letters to families on Wednesday, the Toronto District School Board, Peel District School Board and Calgary Board of Education said they had been contacted by a “threat actor demanding a ransom.”Each school board says PowerSchool is not reporting that new information has been accessed, and it’s believed the data being used for ransom is what was obtained in December 2024.PowerSchool, the U.S.-based company that provides the student information system that was breached, said on Wednesday that it was aware that school boards and districts across North America had been contacted.“We do not believe this is a new incident, as samples of data match the data previously stolen in December,” the company wrote. “We sincerely regret these developments – it pains us that our customers are being threatened and re-victimized by bad actors.” Story continues below advertisement
if ( typeof( gn_monetize ) !== 'undefined' && typeof( gn_monetize.Ads ) !== 'undefined' && gn_monetize.Ads.initialRequestMade() ) {
// Ads script has been loaded, create the ad.
gn_monetize.Ads.create( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-10","lazy":false,"targeting":{"pos":10,"slotid":"gpt-ad-300250-10"},"companion":false} );
} else {
// if Ads script not yet loaded, queue up ad data for initialization.
var gnAdSettings = gnAdSettings || {};
gnAdSettings.ads = gnAdSettings.ads || [];
gnAdSettings.ads.push( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-10","lazy":false,"targeting":{"pos":10,"slotid":"gpt-ad-300250-10"},"companion":false} );
}
It said it had reported the matter to law enforcement in both Canada and the U.S. and was working with customers to support them.
2:08
Calgary law firm files lawsuit over massive PowerSchool data breach
The company said following the December breach that it had paid a ransom, as it believed it would be “in the best interest of our customers.”
Get breaking National news
For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen.
Sign up for breaking National newsletter
Sign Up
By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy.
The Peel, Toronto and Calgary school boards said in their letters that the company had previously told them the data that had been accessed had been deleted with no copies posted online, but that was not the case.“As with any such incident, there was a risk that the threat actors would not honour their commitment to delete the stolen data, despite assurances from PowerSchool,” the Calgary Board of Education wrote in its letter, which added it had not paid or contributed to any ransom payment. Story continues below advertisement
if ( typeof( gn_monetize ) !== 'undefined' && typeof( gn_monetize.Ads ) !== 'undefined' && gn_monetize.Ads.initialRequestMade() ) {
// Ads script has been loaded, create the ad.
gn_monetize.Ads.create( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-11","lazy":true,"targeting":{"pos":11,"slotid":"gpt-ad-300250-11"},"companion":false} );
} else {
// if Ads script not yet loaded, queue up ad data for initialization.
var gnAdSettings = gnAdSettings || {};
gnAdSettings.ads = gnAdSettings.ads || [];
gnAdSettings.ads.push( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-11","lazy":true,"targeting":{"pos":11,"slotid":"gpt-ad-300250-11"},"companion":false} );
}
The original breach happened in December, with boards across multiple provinces contacted.Global News contacted every school board across the country earlier this year to determine how many were impacted. Of those that responded, at least 87 were affected.
Trending Now
What to know about search for 2 missing siblings in rural Nova Scotia
Woman awarded $55K by tribunal after being compared to Darth Vader
Data from those that provided numbers showed that more than 2.77 million current and former students were confirmed to have been affected. In addition, 35,951 staff members, including teachers, were confirmed impacted, with one Nova Scotia school board advising that 3,500 parents’ data was also accessed.
More on Canada
More videos
What to know about search for 2 missing siblings in rural Nova Scotia
No interprovincial trade barriers by Canada Day? Why Carney faces uphill battle
Assaults, bomb threats, Nazi salutes: Canada’s courts are starting to convict those targeting Jews
Canadian Blood Services plans to recruit 1 million donors over next 5 years
‘They were laughing at me’: Female complainant tells world junior sex assault jury
Search for missing siblings in Pictou County enters 5th day
Former Canadian diplomat on Carney-Trump White House meeting
Carney’s visit to Washington for face-to-face meeting redefining relationship with Trump
Data including people’s names, contact information, date of birth, limited medical alert information and, in some cases, social insurance numbers was accessed, according to both PowerSchool and several school boards. No SINs were accessed, however, at the Toronto, Peel and Calgary school boards that alerted parents this week.According to various officials and public statements from school boards, data breaches have been seen in Alberta, Saskatchewan, Manitoba, Ontario, Northwest Territories, Nova Scotia, Prince Edward Island, and Newfoundland and Labrador.Quebec, New Brunswick, Nunavut, British Columbia and Yukon officials said their boards were not impacted.Canada and Ontario’s privacy commissioners said earlier this year that they were investigating the breach.In a statement to Global News, a spokesperson for Canada’s privacy commissioner said the company had made it aware of the incident and remains “actively engaged” to ensure PowerSchool is taking steps to respond to the breach. Story continues below advertisement
if ( typeof( gn_monetize ) !== 'undefined' && typeof( gn_monetize.Ads ) !== 'undefined' && gn_monetize.Ads.initialRequestMade() ) {
// Ads script has been loaded, create the ad.
gn_monetize.Ads.create( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-12","lazy":true,"targeting":{"pos":12,"slotid":"gpt-ad-300250-12"},"companion":false} );
} else {
// if Ads script not yet loaded, queue up ad data for initialization.
var gnAdSettings = gnAdSettings || {};
gnAdSettings.ads = gnAdSettings.ads || [];
gnAdSettings.ads.push( {"sizes":"[300,250]","biddable":true,"id":"gpt-ad-300250-12","lazy":true,"targeting":{"pos":12,"slotid":"gpt-ad-300250-12"},"companion":false} );
}
The commissioner’s office said it could not provide further details as its investigation is ongoing.A class-action lawsuit was also launched earlier this year by Calgary law firm Cuming and Gillespie, though lawyer Craig Gillespie told Global News there was “no urgent call to action” for people to get involved at this time, as it still needs to be certified. Notices will go out for people to join once that occurs.