Nearly 1.5 million students — both current and former — at Canada’s largest school board are among those who have been impacted by the data breach of PowerSchool, used by schools across North America to store student and staff data.
According to an email from a Toronto District School Board spokesperson, approximately 1.49 million students were impacted.
“I can confirm approximately 1.49 million TDSB students were impacted,” said Emma Moynihan, communications adviser for the school board.
The data was confirmed by the board when Global News inquired about numbers reported by the online news site BleepingComputer, which had obtained information into the scope of the data breach of PowerSchool.
Global News has not independently confirmed the numbers reported by BleepingComputer, which allege the data of more than 62 million students and 9.5 million teachers across North America were impacted.
The report said among the largest school districts impacted by the breach was the Toronto District School Board, citing approximately the same number of students impacted as the numbers provided by the school board to Global News.
Other Canadian school boards listed included the Peel District School Board and Calgary Board of Education. Global News reached out to both to confirm the numbers reported and did not hear back from Peel’s board, however Calgary’s said it was looking into the request.
The TDSB data impacted by the data breach dates back as far as 1985.
Information such as health card numbers, home addresses and phone numbers for students who attended a TDSB school anytime between 1985 and 2017 may have been impacted, while medical information, principal notes and dates of birth for students attending between 2017 and December 2024 may also be among the information compromised in the breach.
The school board told Global News that while it did not have total numbers for staff impacted, it said first, middle and last names, employee numbers and TDSB email addresses of some staff were impacted.
It also said those whose data may have been accessed or acquired include teachers, principals, office staff, superintendents, guidance counsellors and classroom support staff like educational assistants.
The PowerSchool data breach occurred between Dec. 22 and 28, with data from schools in multiple provinces affected.
The U.S.-based provider of cloud software said on its website that some “personally identifiable information,” such as social security numbers and medical information “was involved” in the breach and was working with “urgency” to identify those impacted.
Canada’s privacy commissioner, Philippe Dufresne, announced last week he was communicating with the company in response to the data breach, adding this past Monday he was “concerned” about the potential impact that the incident could have on personal information of students across the country.
He said his office is working to obtain more information about the breach and also provide PowerSchool information about its breach response and reporting requirements under Canada’s privacy regulations.
In a statement to Global News, PowerSchool said it recognized the “significance of this incident and are sincerely regretful that it occurred,” and has worked to prioritize transparency and direct communication with its customers.
Asked to confirm if the numbers reported in the BleepingComputer post were accurate, the company said it did not “intend to downplay the numbers reported in this article,” but it stressed it expects the majority of customers impacted, “in fact, more than three quarters,” did not have social security numbers exfiltrated.
The company added it would be offering two years of complimentary identity protection services and two years of complimentary credit monitoring services for all applicable students whose information was involved.
— with files from The Canadian Press