Cyber incident hits Toronto and GTA school boards, compromising student information systems

The Toronto District School Board (TDSB) and the Peel and York Region public boards are among those currently impacted by a cyber incident involving software used to store a range of student information.

On Wednesday, the TDSB sent a letter to parents explaining the incident involving the PowerSchool software, which is used by many boards across North America.

“Our cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational,” the TDSB’s Interim Director of Education, Stacey Zucker, wrote in the letter.

“Working with PowerSchool, we are conducting a thorough investigation to understand the nature of the incident and what personal information may have been affected. At this point in time, we are still assessing the exact information that may have been accessed or exported from the application. PowerSchool informed us that it has received confirmation that the data accessed by an unauthorized user has been deleted and that no copies of this data were posted online.”

Zucker said that “if it is determined that any personal information has been impacted, we will let you know as soon as possible,” adding that “in the meantime, and out of an abundance of caution, we have notified the Information and Privacy Commissioner of Ontario.”

The Peel District School Board, York Region District School Board and the Durham District School Board have also notified staff and families.

According to “PowerSchool,” the data breach happened between Dec. 22 and Dec. 28.

“On December 28, 2024, we became aware of a potential cybersecurity incident involving unauthorized access to certain PowerSchool SIS information through one of our community-focused customer portals, PowerSource. We have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. The incident is contained and we do not anticipate the data being shared or made public. PowerSchool is not experiencing, nor expects to experience, any operational disruption and continues to provide services as normal to our customers,” a spokesperson for PowerSchool said in a statement.

“As soon as we learned of the incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts.”

Late Wednesday, the Upper Canada District School Board, headquartered in Brockville, Ont., noted they, too, had been affected by the cyber incident, indicating that personal data had not been compromised. Kingston police also responded to a cyber incident that was detected on Friday. 

Neither the school board nor the police have said what’s behind the cyber incidents.