The federal privacy watchdog has ceased its investigation into a widespread cybersecurity breach impacting a student information system across Canada, citing satisfaction with the company’s response and its commitment to enhanced security measures.
The decision was announced by privacy commissioner Philippe Dufresne on Tuesday.
The probe, initiated in February, stemmed from a breach report filed by US-based PowerSchool, the provider of the affected software, and a subsequent complaint.
A hacker had illicitly obtained sensitive data, including names, contact information, birth dates, and in some instances, medical details and Social Insurance Numbers. The compromised information pertained to current and former students, educators, and parents across various provinces and territories.
PowerSchool, in response to the breach, took steps to contain the intrusion, notify affected individuals and organizations, and offer credit protection services.
The company has also voluntarily committed to implementing additional security measures, such as bolstering monitoring and detection tools, The Canadian Press reported.
Dufresne’s office indicated that these proactive steps prompted the discontinuation of the federal investigation.
“I welcome PowerSchool’s willingness to engage with my office to achieve a timely resolution that will result in stronger protections for the personal information of students, parents, and educators across Canada,” Dufresne stated in a press release.
He emphasized the importance of robust security safeguards, especially concerning children’s personal information.
Despite the federal probe’s conclusion, ongoing investigations by provincial privacy watchdogs in Ontario and Alberta into the breach remain unaffected. The federal office will continue to monitor PowerSchool’s adherence to its pledged security enhancements.
In May, the Toronto District School Board, Canada’s largest school board, informed parents that data stolen in the December 2024 breach had not been destroyed, and a “threat actor” had demanded a ransom.
PowerSchool confirmed it paid the ransom, stating, “We made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve.”
PowerSchool has further committed to providing evidence of strengthened security monitoring tools by the end of 2025 and an independent security assessment report of its information safeguards by March 2026.
What are your thoughts on the federal privacy watchdog’s decision to discontinue its investigation? Share your insights in the comments below.
