Toronto school district says vendor data breach impacted student data dating back 40 years

The Toronto school district, Canada’s largest school board, said a data security incident impacting technology provider PowerSchool has compromised student information dating back as many as 40 years.

 

In a letter sent to parents and caregivers, the school district known as TDSB said that on January 7, its K-12 software and cloud-based solutions provider, PowerSchool, notified the school board that it had experienced a  significant data security incident that involved threat actors infiltrating its internal network and stealing a massive trove of student data.

 

The breach was first identified on December 28 when PowerSchool discovered that the threat actor had accessed and exported data using “export data manager”. According to the company’s investigation, hackers gained access to its network via compromised credentials that also enabled them to steal data from PowerSchool SIS databases, including sensitive information stored in the “Students” and “Teachers” tables.

 

The stolen data included names, addresses, Social Security Numbers, grade point averages, medical information, and more.

 

Soon after it was notified about the incident, TDSB initiated its own investigation with assistance from external cyber security experts to determine the scope of the incident. The investigation revealed that “students with TDSB between September 3, 1985 to December 28, 2024” had their personal data compromised during the incident.

 

The compromised data included students’ names, dates of birth, gender, health card numbers, Ontario education numbers, medical Information, home addresses, phone numbers and more.

 

TDSB added that the sensitive personal information of parents and caregivers who were associated with the school board between September 1, 2017 and December 28, 2024 also had their personal data compromised. The affected data included names, home & mobile phone numbers, home addresses, email addresses, and relationship to student.

 

“TDSB can confirm that our environment is secure, and that there is no ongoing unauthorised access to any data, either stored in PowerSchool’s Student Information System or elsewhere.

 

“TDSB does not store any Social Insurance Numbers, financial or banking information in the PowerSchool Student Information System, so that information was not affected in any way,” the school board added.