Alberta’s privacy commissioner has urged schools to enhance their cybersecurity measures following a significant breach last year that exposed sensitive information of hundreds of thousands of students. A recent report highlighted that 33 public, charter, and Francophone schools, along with school boards, were affected by a breach involving the education software provider PowerSchool. This breach exposed personal data such as names, birthdates, addresses, social security numbers, academic records, and medical information, impacting students, parents, and staff.
The investigation revealed that many school authorities did not have adequate privacy and security provisions in their contracts with PowerSchool, failing to meet provincial privacy regulations. Additionally, there was a lack of effective monitoring of PowerSchool’s security measures. Although the federal privacy watchdog has discontinued its investigation, citing satisfaction with PowerSchool’s response, the provincial commissioner emphasized that both the vendor and schools share responsibility for ensuring data security.
The breach was traced back to the use of stolen credentials from a contractor, granting access to sensitive systems. The report identified weaknesses such as the absence of multi-factor authentication and insufficient restrictions on remote access. Recommendations were made for school boards, PowerSchool, and the provincial government to enhance data protection, including improving procurement processes and offering guidance to school boards.
The report also called for stronger security measures from PowerSchool, including multi-factor authentication and regular security updates. The situation underscores the broader challenge of safeguarding student data as educational technology becomes more prevalent in classrooms. Alberta’s education minister has committed to supporting school boards in strengthening their cybersecurity practices.
