The Calgary Board of Education informed parents of a data breach involving PowerSchool, a software used for student information, potentially impacting thousands of students and teachers.
According to an email sent out to parents on Thursday morning, the district was informed on Tuesday of a “cybersecurity incident” involving PowerSchool on Tuesday, Jan. 7. CBE officials said they have been advised that student and staff information “may have been accessed.” They are currently working with PowerSchool to determine the scope of the incident and any potential impact on families and staff.
The Calgary Board of Education has more than 142,400 students, and more than 16,000 employees.
Officials also said the CBE immediately limited third-party access to PowerSchool.
“PowerSchool has also notified law enforcement, locked down its system, and changed all passwords,” the email to parents read.
“While we work to determine what data may have been accessed, we can confirm that PowerSchool does not store financial information. PowerSchool remains available for school and family use.”
A similar e-mail was sent to parents in the Red Deer public school system on Jan. 8. In that email, it informed parents that the breach had impacted schools across Canada, the United States and other parts of the world. Their email said that it involved current and past student and staff information stored within the system, noting that the breach “compromised student data that includes: Student names, student mailing addresses, Dates of birth – students only, student phone numbers, basic student medical information (in some cases), such as details about asthma, diabetes, or allergies.”
A spokesperson for the Calgary Catholic School District told LWC that it was not affected by the data breach.
“We remain committed to protecting the privacy and security of our students’ and families’ information,” the spokesperson said in an emailed statement.
Company said incident is contained
A PowerSchool spokesperson told LiveWire Calgary in an emailed statement that the company became aware of a “potential cybersecurity incident” involving unauthorized access to PowerSchool information through Powersource, a community-based customer portal, on Dec. 28, 2024.
The spokesperson has taken “all appropriate steps to prevent the data involved from further unauthorized access or misuse.”
“The incident is contained and we do not anticipate the data being shared or made public. PowerSchool is not experiencing, nor expects to experience, any operational disruption and continues to provide services as normal to our customers,” the emailed statement read.
“As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts.”
Alberta Education Minister Demetrios Nicolaides told LiveWire Calgary in an emailed statement he is aware of the data breach and is taking it seriously.
“Alberta school authorities that have contracts with PowerSchool are working directly with the organization to understand and address any impacts of this breach as we do not require them to use this program nor are we a partner in agreements between school authorities and PowerSchool,” the statement read.
“We are currently working with our education stakeholders to assess the impact of this incident. It is my expectation that all impacted school boards directly communicate with parents and staff as soon as possible.”
