Alberta Privacy Commissioner Investigating Widespread PowerSchool Data Breach
Alberta’s Privacy Commissioner is joining the investigation into the recent and widespread data breach that affected dozens of educational institutions across the province. In late December, hackers gained access to the U.S.-based PowerSchool platform used by schools and educational institutions throughout North America including the Fort McMurray Public School Division.
The Office of the Information and Privacy Commissioner (OIPC) confirmed it has received 31 breach notices from Alberta schools and educational institutions reporting unauthorized access to student and educator personal information. PowerSchool, a cloud-based platform used worldwide for school data management, acknowledged the breach involved unauthorized extraction of personal data through one of its customer support portals.
The exposed data includes names, phone numbers, dates of birth, genders, grades, school-issued email addresses, Alberta student ID numbers, and school-issued ID numbers. In some cases, private health-related information was also compromised, including details about allergies, medications, medical conditions, personal health numbers, physician contact details, and guardian information.
Information and Privacy Commissioner Diane McLeod said her office is working with privacy regulators across Canada to address the breach and ensure protective measures are taken to prevent similar incidents in the future.
“I take the privacy rights of Albertans, and in particular children, very seriously,” said McLeod. “We are in the beginning stages of our review and will work with affected institutions to mitigate risks. While we are still determining the total number of affected Albertans, it is clear the impact is significant, particularly among students.”
Fort McMurray Public School Division notified stakeholders in January that they were among the school divisions with compromised data, and that those impacted would be contacted directly. The Fort McMurray Catholic Schools, which use a different software system, were not affected by the breach.
PowerSchool has offered free credit monitoring and identity theft protection for those impacted. Individuals who have received notification of the breach are advised to contact their educational institution for further details. The OIPC has also directed Albertans to its website for information on privacy rights under Alberta’s laws.