Ontario school boards are working with police and privacy commissioners as they deal with the continuing threat from a massive cyber attack that stole the sensitive information of millions of current and former students.
Just this week, a number of school boards in the Greater 海角社区官网Area notified families that the private information obtained in the December incident had not been destroyed, despite PowerSchool 鈥 a third-party, cloud-based storage provider 鈥 having paid ransom and received assurances that it would be.
Several school boards have since been targeted individually with ransom demands, including the 海角社区官网District School Board, the country’s largest.
“We are deeply concerned about the latest ransom demand and the continued risk of sensitive personal information of students and staff being exposed,” the Office of the Information and Privacy Commissioner of Ontario said in a statement to the Star.
“Ransomware attacks have become an increasingly dangerous threat to the security of personal information and records.”
Ryan Bird, the TDSB executive officer of communications and public affairs, said “we have contacted 海角社区官网Police, among other law enforcement agencies. We have also continued to keep the Information and Privacy Commissioner of Ontario informed and we are supporting in any way we can.鈥
The 海角社区官网board, and others in Canada and the U.S., “received a communication from a threat actor demanding a ransom using data from the previously reported December 2024 incident,” said an email sent to parents.
About 20 boards in Ontario have been impacted overall, with student data compromised from up to 60 years ago.
While the stolen personal information varies, it can include names, gender, birthdates, grades, health numbers and medical conditions. No financial information or social insurance numbers were obtained.聽
PowerSchool continues to offer current and former students two years of free credit and identity monitoring.
The Office of the Privacy Commissioner of Canada was contacted about the incident and said it “remains actively engaged with PowerSchool to ensure that the organization is taking appropriate steps to respond to the breach. The OPC鈥檚 investigation into this matter remains ongoing.”
A PowerSchool spokesperson said the recent ransom demands are not believed to be new, “as samples of data match the data previously stolen in December,” and that the company is working with police and customers in Canada and the U.S.
“We sincerely regret these developments 鈥 it pains us that our customers are being threatened and re-victimized by bad actors,” the spokesperson said. “Any organization facing a ransomware or data extortion attack has a very difficult and considered decision to make 鈥 we made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve.”
The Dufferin-Peel Catholic District School Board told parents in an email that it had not been targeted in the more recent demand for ransom. The Durham District School Board, which was also targeted last December, has not been contacted directly for ransom, and will also be sending out a note to families.
At Queen’s Park, NDP Leader Marit Stiles said school boards and parents “have a right to be concerned about cybersecurity right now 鈥 but when it comes to what do they prioritize when they’re facing massive (budget) cuts, is it going to be cybersecurity or is it going to be making sure that kids get a snack program?”
The Halton Catholic board has also sent an email to staff and parents, saying to date, it “has not been contacted by the unauthorized user” demanding ransom.
The Peel District School Board said Peel police are aware of the cyber attack. “We recognize that this news may cause concern,” director of education Rashmi Swarup said in a written statement. “We continue to monitor the situation closely and will keep our community informed of any new developments.”
Ontario’s privacy commissioner’s office said that “while private sector companies like PowerSchool are subject to federal privacy law, Ontario school boards remain responsible for the security of personal information they collect 鈥 even when they contract out services.”
Error! Sorry, there was an error processing your request.
There was a problem with the recaptcha. Please try again.
You may unsubscribe at any time. By signing up, you agree to our and . This site is protected by reCAPTCHA and the Google and apply.
Want more of the latest from us? Sign up for more at our newsletter page.
To join the conversation set a first and last name in your user profile.
Sign in or register for free to join the Conversation