Calgary and area school boards affected by PowerSchool breach

The Calgary Board of Education and Rocky View Schools (RVS) said Thursday they were among the many school boards affected by a data breach of a student information system utilized by staff, students and parents.

• Sign up for breaking news alerts from CTV News, right at your fingertips
• The information you need to know, sent directly to you: Download the CTV News App

On Jan. 7, PowerSchool informed RVS,  the public school division that serves students to the west, north and east of Calgary, that its systems were breached on Dec. 28, 2024 by an "unauthorized party."

"(The group) gained access to certain PowerSchool student information system demographic data using one of their corporate support credentials which became compromised," RVS Supt. Greg Luterbach wrote in a letter to parents on Thursday.

Luterbach said the company has employed a third-party security response team to investigate the incident.

"They believe it is contained but they may have obtained some of RVS's student and staff data," he said.

PowerSchool is a third-party company that provides a cloud-based student information system used by many school divisions in Canada, the U.S. and internationally.

Luterbach said there is no information about the extent of the breach and how much personal information was accessed, but assured RVS parents that no financial information was stored in PowerSchool.

"Since we were notified, we have been working to gather additional information from PowerSchool on their investigation and our technology team has been conducting our own investigation," he said.

"We understand the concern this will cause for many of our families and staff, and we assure all those impacted by this situation RVS is taking this very seriously. PowerSchool has committed to sharing more detailed information with us when they have it. We will communicate new information to families and staff as quickly as possible when we know more."

The Calgary Catholic School Division said it was not affected by the recent PowerSchool breach.

CBE working to determine scope

The Calgary Board of Education (CBE), in a statement to CTV News said it, too, was informed of the breach on Jan. 7.

Since then, it took steps to limit access to the system and is investigating to determine how much information was accessed and how to proceed.

"PowerSchool has assured us that the incident is contained and that they’ve strengthened their security measures," the CBE said. "PowerSchool has also notified law enforcement, locked down its system, and changed all passwords."

The CBE added its PowerSchool system does not store financial information.

The PowerSchool data breach has affected several Canadian school boards, including in the Edmonton area.

Schools in the Greater Toronto Area and Nova Scotia have also been impacted.

'Be aware': Cyber expert weighs in

A University of Calgary professor and cyber expert says the situation is bad but more common than most know.

“The PowerSchool software itself might have some sort of vulnerability, or the source could be from phishing attacks or some sort of other outdated systems that are connected,” Dr. Hadis Karimipour said.

Looking at the breach and what was being stored, she calls the system hack a “medium” threat.

“Because cybercriminals can get access to other, more important sources of data or money or information, and they can leverage those sources,” Karimipour told CTV News.

She recommends parents across the country look into what data they had stored on the system and make sure they don’t share passwords.

“The best thing is to not share too much information if it’s not necessary,” she said. “Change that username and password if they are (being) used for other systems.”