Federal probe into massive PowerSchool data breach is being discontinued
The December 2024 hack accessed the personal data — including medical information and social security numbers — of millions of current and former students and thousands of staff across Canada.
The office of privacy commissioner Philippe Dufresne (OPC) said in a news release that PowerSchool 'took measures to contain the breach, notify affected individuals and organizations and offer credit protection, and has voluntarily committed to additional actions to support its security safeguards.'
Those actions include 'strengthened monitoring and detection tools,' the OPC release said.
'In light of the actions that PowerSchool has already implemented, and those that it will implement over the coming months, Privacy Commissioner of Canada Philippe Dufresne has decided to discontinue the investigation that he launched in February but will be monitoring to ensure that all of PowerSchool's commitments are fully met,' it continued.
Story continues below advertisement
'I welcome PowerSchool's willingness to engage with my Office to achieve a timely resolution that will result in stronger protections for the personal information of students, parents, and educators across Canada,' Dufresne said in a statement.
'Federal privacy law requires that organizations protect personal information with security safeguards appropriate to the sensitivity of the information. This is particularly important when dealing with children's personal information.'
2:08
Calgary law firm files lawsuit over massive PowerSchool data breach
Dufresne's investigation began more than a month after the company began to notify PowerSchool users about the data breach, which impacted school boards across most of North America and other countries that PowerSchool serves.
Get daily National news
Get the day's top news, political, economic, and current affairs headlines, delivered to your inbox once a day. Sign up for daily National newsletter Sign Up
By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy
Global News contacted every school board across the country early this year to determine how many were impacted. Of those that responded, at least 87 were affected.
Data from those that provided numbers showed that more than 2.77 million current and former students were confirmed to have been affected. In addition, 35,951 staff members, including teachers, were confirmed impacted, with one Nova Scotia school board advising that 3,500 parents' data was also accessed.
Story continues below advertisement
Some Canadian school boards informed families in May that they had received new ransom demands involving the stolen data.
A Massachusetts college student, 19-year-old Matthew Lane, agreed in May to plead guilty to criminal charges related to the data breach, including cyber extortion, according to U.S. prosecutors. Sources close to the investigation told The Associated Press and Reuters that PowerSchool was the company identified as 'Victim 1' in the criminal complaint.
0:38
Teen charged in mass school data breach tied to PowerSchool
What did PowerSchool agree to?
According to a letter of commitment with the OPC signed last week and released Tuesday, PowerSchool has until the end of July to provide any additional information related to the data breach to the commissioner, and to confirm if it plans to implement any additional authentication process in its affected PowerSource platform.
Story continues below advertisement
The company will need to provide evidence by the end of this year that it has strengthened its monitoring and detection tools, that those tools can 'identify patterns of irregular activity,' and that it has thoroughly reviewed and readjusted its system access privileges for both security and operational needs.
By March 2026, PowerSchool will need to show that it has obtained recertification of the global information security standard known as ISO/IEC 27001.
It must also provide an independent, third-party security assessment and report to the OPC on PowerSchool's updated safeguards to protect personal information, prevent and respond to potential breaches, and other cybersecurity measures.
If the report includes recommendations for PowerSchool to implement, the company must show the OPC whether it has accepted them and provide an implementation plan and timelines, or provide reasons why it has not accepted them. The commissioner will have to review and approve those submissions.
PowerSchool also agreed to continue supporting affected clients and carry out its regular reporting and notification obligations under federal and provincial privacy laws.
The OPC letter said PowerSchool's commitments are 'a fair and reasonable response to the complaint' that sparked Dufresne's investigation in February.
Global News has asked the office of the Information and Privacy Commissioner of Ontario if its investigation into the PowerSchool data breach remains ongoing.
Story continues below advertisement
'We take the privacy and security of student, educator, and family data extremely seriously,' a PowerSchool spokesperson told Global News in an emailed statement responding to the OPC's announcement.
'Following the 2024 security incident, we worked closely with the Office of the Privacy Commissioner of Canada to respond swiftly, transparently, and responsibly. We're grateful for the Commissioner's collaboration in helping us strengthen our safeguards even further. PowerSchool remains fully committed to making continual investments in our security infrastructure and the ongoing support of our education partners across Canada.'
— with files from Global's Sean Previl
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
CTV News
an hour ago
- CTV News
Laws around intimate partner violence questioned in wake of Madisson Cobb's shooting death
Advocates for victims of domestic violence are calling on Ottawa to create a new section of the Criminal Code to help prevent future tragedies. Advocates for victims of domestic violence are calling on Ottawa to create a new section of the Criminal Code to help prevent future tragedies. Looking to Ottawa for changes to domestic violence laws The recent shooting death of Madisson Cobb in a Haysboro parkade is sparking calls for change to laws relied upon by police in cases of domestic violence. Cobb's ex-boyfriend, Devon Bradley Malik, is charged with first-degree murder. Cobb had a restraining order against Malik at the time. 'She did everything she was supposed to do. She got out. She got the protection order; she got all of it, and it still wasn't enough,' said Jordan Guildford, founder of Gems for Gems, an organization committed to awareness and fundraising for victims. 'Our laws are just not strict enough.' An ambassador with her organization is arranging a rally at Municipal Plaza at noon on Saturday. 'The whole point of it is to raise awareness about the change that needs to happen,' said Guildford. Speakers include family of victims, police and domestic violence prevention advocates. 'Everyone can do something to end this cycle,' said Guildford. Malik's family members spoke to CTV News, saying he continued to obsess over and harass Cobb. It's alleged he was even GPS-tracking her car despite the court order to stay away. He was also charged with criminal harassment before her death. Officials with Sagesse Domestic Violence Prevention Society say criminal charges are more effective than restraining or protection orders. 'Often, when someone pursues a restraining order or protection order, they are pursuing it because it's their only avenue. But if there were coercive control legislation, there might be an avenue that actually allows the police to lay charges, which then puts that perpetrator into a different place in terms of how the system is going to watch them,' said Andrea Silverstone, Sagesse CEO. Canadian lawmakers were close to passing a law that would make 'coercive control' a criminal offence. Bill C-332 died when the election was called, and its fate is unknown until Parliament resumes in the fall. Police have announced a charge of first-degree murder in the death of Madisson Cobb. Madisson Cobb With Cobb's death now before the courts, Calgary police will not comment specifically on that case, but sent CTV News a statement, which read in part: 'While we are unable to comment on specific legislative proposals, we support any measures that enhance public safety and our ability to protect the community. Coercive control is a pattern of behaviour we frequently encounter in domestic violence cases. Additional legal tools that recognize and address this form of abuse could strengthen our efforts to support victims and hold offenders accountable.' In May, the province announced 'Alberta's 10-Year Strategy to End Gender-Based Violence,' outlining more than 100 targeted actions to prevent violence and support survivors. 'This includes significant investments in prevention, education and survivor services,' according to a statement sent to CTV News on Tuesday. It continued, 'Alberta is firmly committed to ending all forms of gender-based violence, and we recognize the growing concern around intimate partner violence (IPV). While some have called for IPV to be formally declared an epidemic, Alberta remains focused on leading with action rather than symbolic declarations to address the root causes and impacts of not only IPV but gender-based violence in its entirety.' The press secretary for Alberta's Ministry of Arts, Culture and Status of Women says an announcement is expected next week on the topic. Questions about strengthening surveillance of violators of restraining orders and protection orders were not answered in time for deadline.
Global News
an hour ago
- Global News
Defence seeks no jail time for B.C. spa owner convicted of sexually assaulting 7 women
A Burnaby spa operator convicted of sexually assaulting seven women while providing 'vaginal tightening' treatments should not spend any additional time behind bars, his lawyer has argued. A jury convicted Farshad Khojsteh-Kashani of seven counts of sexual assault in April, and he has been in custody since. At trial, jurors heard that many of the victims had come to him seeking other treatments when he introduced them to the invasive vaginal procedure, which is performed with an 18-centimetre wand. The trial heard that Khojsteh-Kashani had rubbed victims' clitorises and penetrated them with his fingers. The court heard he asked one victim if using the wand had 'turned her on' and asked another if she wanted him to 'finish her off.' On Thursday, defence lawyer Joel Whysall argued his client should be sentenced to a conditional sentence, to be served in the community, of two-years less a day followed by three years of probation. Story continues below advertisement 2:12 Sentencing hearing for Burnaby spa owner's sexual assault trial Whysall argued that Khojsteh-Kashani has no criminal record, is not a significant risk to reoffend, and has 'already forfeited so much' in terms of his career and business. 'This conviction, that's it. It's all in the garbage and will never come back,' he told the court, adding Khojsteh-Kashani has already been subject to public shaming and media attention. Get breaking National news For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen. Sign up for breaking National newsletter Sign Up By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy The 52-year-old, who described himself on his website as 'Dr. Farshad,' is not licenced doctor in Canada, however was trained as one in Iran the court heard. On Thursday, Khojsteh-Kashani addressed the court through an interpreter, saying that before 'this happened to him' he had a 19-year career, including as a GP, where he saw approximately 100,000 clients, about three-quarters of them women, and that 'you cannot find even one complaint.' Whysall told the court Khojsteh-Kashani's offending was 'situational,' and limited to the use of the wand during the tightening procedures. He said Khojsteh-Kashani had obtained the device and thought he could handle using it, but could not. Story continues below advertisement 'He took leave of his senses due to the temptation … he gave in to his lust and temptation and he lost his mind,' he argued. 'We're not dealing with someone who's touched a child, he's not a pedophile.' On Wednesday, the court heard victim impact statements from the women Khojsteh-Kashani assaulted, who described the lasting emotional damage of the incidents. 'I trusted Farshad…but instead he betrayed my trust in the worst, violating way possible … He hurt me physically and psychologically,' one woman told the court 'I will never forget how vulnerable and violated I felt that day,' another said through tears. 'Just driving past the location in Burnaby sends chills through my spine.' Whysall argued the only aggravating factor in the case was the trust the women had placed in Khojsteh-Kashani, though he acknowledged he denied the offences and that he did not plead guilty, which could have been a mitigating factor. The Crown is seeking a sentence of 12 years and three months in prison and a lifetime entry on the sex offender registry. Khojsteh-Kashani has been in jail since April 2, when a B.C. Supreme Court jury found him guilty of seven sexual assaults at Fab Skin Care over two and a half years starting in 2019. Story continues below advertisement Justice Lisa Warren has reserved her decision until at least mid-September.
Global News
2 hours ago
- Global News
Fitness hearing for Lapu Lapu Day attack suspect hears from 2 psychiatrists
The man accused of driving an SUV into a crowded Vancouver street festival, killing 11 people and injuring dozens more, was back in court on Thursday for more submissions on his fitness to stand trial. Kai-Ji Adam Lo is facing 11 counts of second-degree murder for allegedly ploughing into the Lapu Lapu Day festival on April 26. Lo appeared in court via video link. A publication ban remains in effect, covering much of what was discussed in court on Thursday. 1:08 Lapu Lapu Day tragedy suspect in court for fitness hearing However, Global News can report the judge heard evidence from two psychiatrists, including Dr. Rakesh Lamba, the interim medical director at B.C.'s Forensic Psychiatric Hospital, better known as Colony Farm. Story continues below advertisement The court is trying to determine if Lo is mentally fit to stand trial, and if he can understand and participate in his own defence. Get daily National news Get the day's top news, political, economic, and current affairs headlines, delivered to your inbox once a day. Sign up for daily National newsletter Sign Up By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy After Thursday's proceedings, the hearing is scheduled to take a month-long break before the Crown and defence will return to make their final arguments. In the wake of the attack, investigators disclosed that Lo had extensive prior mental health interactions with police. Vancouver police said Lo had contact with police in a neighbouring municipality the day before the vehicle ramming. That interaction, however, was not criminal in nature and 'did not rise to the level where mental health intervention was required.'
