Some Canadian school boards say they’ve been the target of ransom attempts in relation to the massive data breach of PowerSchool, which saw millions of current and former students across the country impacted.
In letters to families on Wednesday, the Toronto District School Board, Peel District School Board and Calgary Board of Education said they had been contacted by a “threat actor demanding a ransom.”
Each school board says PowerSchool is not reporting that new information has been accessed, and it’s believed the data being used for ransom is what was obtained in December 2024.
PowerSchool, the U.S.-based company that provides the student information system that was breached, said on Wednesday that it was aware that school boards and districts across North America had been contacted.
“We do not believe this is a new incident, as samples of data match the data previously stolen in December,” the company wrote. “We sincerely regret these developments – it pains us that our customers are being threatened and re-victimized by bad actors.”
It said it had reported the matter to law enforcement in both Canada and the U.S. and was working with customers to support them.
The company said following the December breach that it had paid a ransom, as it believed it would be “in the best interest of our customers.”
Get daily National news
Get the day’s top news, political, economic, and current affairs headlines, delivered to your inbox once a day.
The Peel, Toronto and Calgary school boards said in their letters that the company had previously told them the data that had been accessed had been deleted with no copies posted online, but that was not the case.
“As with any such incident, there was a risk that the threat actors would not honour their commitment to delete the stolen data, despite assurances from PowerSchool,” the Calgary Board of Education wrote in its letter, which added it had not paid or contributed to any ransom payment.
The original breach happened in December, with boards across multiple provinces contacted.
Global News contacted every school board across the country earlier this year to determine how many were impacted. Of those that responded, at least 87 were affected.
Data from those that provided numbers showed that more than 2.77 million current and former students were confirmed to have been affected. In addition, 35,951 staff members, including teachers, were confirmed impacted, with one Nova Scotia school board advising that 3,500 parents’ data was also accessed.
Data including people’s names, contact information, date of birth, limited medical alert information and, in some cases, social insurance numbers was accessed, according to both PowerSchool and several school boards. No SINs were accessed, however, at the Toronto, Peel and Calgary school boards that alerted parents this week.
According to various officials and public statements from school boards, data breaches have been seen in Alberta, Saskatchewan, Manitoba, Ontario, Northwest Territories, Nova Scotia, Prince Edward Island, and Newfoundland and Labrador.
Quebec, New Brunswick, Nunavut, British Columbia and Yukon officials said their boards were not impacted.
Canada and Ontario’s privacy commissioners said earlier this year that they were investigating the breach.
In a statement to Global News, a spokesperson for Canada’s privacy commissioner said the company had made it aware of the incident and remains “actively engaged” to ensure PowerSchool is taking steps to respond to the breach.
The commissioner’s office said it could not provide further details as its investigation is ongoing.
A class-action lawsuit was also launched earlier this year by Calgary law firm Cuming and Gillespie, though lawyer Craig Gillespie told Global News there was “no urgent call to action” for people to get involved at this time, as it still needs to be certified. Notices will go out for people to join once that occurs.
© 2025 Global News, a division of Corus Entertainment Inc.
