A data breach affecting multiple schools across Canada and the United States — including the Brant Haldimand Norfolk Catholic District School Board (BHNCDSB) — involved medical records and other personal information in some cases.
Article content
The cybersecurity incident involves PowerSchool, a third-party platform that manages a range of student and staff details, like personal contact information, marks and class schedules.
But for some customers, the breach involved confidential information “such as social security numbers and medical information,” a PowerSchool spokesperson told the Spectator in an email Thursday night.
While multiple boards in the Hamilton area use the US-based provider of cloud software, BHNCDSB was the only one that reported being affected.
“We were notified late Tuesday… that our board is involved. However, at this time, we do not know to what extent,” board spokesperson Tracey Austin told the Spectator Thursday afternoon.
Article content
“PowerSchool has committed to more information on or before January 17th so we may have to wait until then,” the school board said Friday when asked if social insurance numbers or medical records of staff and students were involved.
The platform is investigating the breach and working with the board to identify “exactly what may have been shared,” read a letter parents received Thursday afternoon.
PowerSchool did not tell The Spectator why they believe the information won’t be shared or made public.
But they have “strengthened PowerSource password policies and controls” as part of “ongoing efforts to enhance our resilience,” a spokesperson told The Spectator Friday evening.
While some boards — like the Toronto District School Board and Peel District School Board — were affected, others that use the platform — like Grand Erie District School Board and Hamilton-Wentworth District School Board — had no issue.
Article content
The platform became aware of a “potential cybersecurity incident” on Dec. 28, 2024, that involved “unauthorized access to certain PowerSchool … information through one of our community-focused customer portals, PowerSource,” a spokesperson told the Spectator in an email.
The platform is investigating the breach and working with the board to identify “exactly what may have been shared.” In the meantime, “they have assured us that they have taken all the appropriate steps to prevent further unauthorized access or misuse of the affected data,” said the board letter to parents.
PowerSchool’s website shows it manages a range of information, including: personal information such as name, date of birth, email address, student ID, financial information, SIN numbers and health records; digital documents like transcripts, transfer letters, attendance letters and discipline events; student records like attendance records, report cards and course enrollment; plus employee records.
In its statement, PowerSchool said it is “supporting our customers by providing more information and resources, including credit monitoring or identity protection services if applicable.”
The board recognizes “that staff and families may have questions,” but as “the cybersecurity incident occurred with the vendor and not BHNCDSB, we do not have more information to share at this time,” Austin told the Spectator.
Celeste Percy-Beauregard is a Local Journalism Initiative Reporter based at the Hamilton Spectator. The initiative is funded by the Government of Canada.
Share this article in your social network