Software used by multiple Edmonton-area school divisions target of cyber attack

Edmonton's Catholic and St. Albert's Catholic and public school divisions are among the school boards in multiple provinces that have been affected by a data breach of their student information system vendor.

• Sign up for breaking news alerts from CTV News Edmonton, right at your fingertips

In a notice emailed to families on Wednesday afternoon and in a statement posted to the division's website, Edmonton Catholic School Division (ECSD) said it was working with U.S.-based PowerSchool to determine exactly what data was accessed.

Families can use the cloud software to check their child's grades or pay school fees, although ECSD said "no financial information was accessed or is stored in PowerSchool."

"PowerSchool has assured us that the incident is contained and that they’ve strengthened their security measures to prevent future breaches. PowerSchool’s operations remain unaffected, and service continues as usual," ECSD's statement read.

"Additionally, you do not need to change your password as login information is not impacted."

St. Albert Public Schools families were also told by email that financial data and passwords were not compromised, but that names, birth dates, phone numbers and home/mailing addresses were "exported" from individual accounts.

"We understand that news like this can be unsettling, and we want to assure you that we are doing everything possible to address the situation responsibly and proactively," the division said, promising to provide more information when it became available.

Greater St. Albert Catholic Schools and Elk Island Public Schools confirmed they were also affected by the breach and echoed the other school divisions in saying no financial data was accessed. However, they said they were still working with Power School to determine the scope of the breach.

Edmonton Public Schools uses PowerSchool but says it was not affected. 

None of the affected schools said their daily operations were impacted by the breach.

According to the PowerSchool website, the software is used by 76 per cent of students in Canada.

So far, school boards in Alberta, Ontario and Newfoundland and Labrador have reported being affected by the breach, according to The Canadian Press. It is used internationally.

Dec. 28 cyber breach

PowerSchool says it learned on Dec. 28 of "unauthorized access to certain information through one of our community-focused customer support portals," called PowerSource.

An investigation confirmed the unauthorized party accessed PowerSchool customer data, the company told clients in a letter shared by ECSD.

"As soon as we learned of the potential incident, we immediately engaged our cybersecurity response protocols and mobilized a cross-functional response team, including senior leadership and third-party cybersecurity experts. We have also informed law enforcement," the letter reads.

While it said the data accessed "relates to families and educators," PowerSchool called the incident contained and said no evidence of malware or continued unauthorized activity has been found.

"Rest assured, we have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination."

• What parents need to know about the PowerSchool data breach

Ritesh Kotak, a cyber security expert, says school boards hold "very rich data" that has monetary value to hackers.

He says the information can be sold for ransom and up for grabs "by anyone else."

"It could be nefarious groups. It could be individuals that may be engaged in child exploitation activities as well," Kotak said. "That is the real scary part of how this data could essentially be weaponized against the community."

With files from The Canadian Press