‘Cyber incident’ affects Manitoba school boards

Two Manitoba school boards have been affected by a data breach involving software to store student information.

The Louis Riel School Division and Portage la Prairie School Division are among school boards across North America affected by a “cyber incident” targeting PowerSchool, a third-party application used to store school-based staff information.

“We are currently investigating the impact of this cybersecurity event in LRSD. At this time, we believe that the data accessed included some specific personal information of students and the name and email address of LRSD staff who are PowerSchool users,” LRSD wrote in a notice on its website.

“Please be assured that the safety and security of our data—particularly the information of your children and of our staff is of paramount importance to us and to PowerSchool. We regret that this has occurred, and we will continue to collaborate on this matter.”

Louis Riel says no other school division systems or data was compromised, and that it is communicating with “the appropriate professionals” as it responds to the situation.

The Portage la Prairie School Division says the breach happened in late December.

“PowerSchool has deactivated accounts and initiated enhanced processes for passwords and access,” the school board wrote on its website. “PowerSchool has provided us with assurances that the accessed data has now been deleted. Furthermore, PowerSchool has confidence that the data was not copied or uploaded elsewhere. PowerSchool is actively engaged with cybersecurity professionals to continue to monitor this event.”

Many other Canadian school boards have been affected, with officials in Alberta, Ontario, and Newfoundland and Labrador say they are working with PowerSchool to determine the extent of the breach.

PowerSchool, a U.S.-based provider of cloud software, says in a statement it has taken “all appropriate steps” to prevent further unauthorized access or misuse of the affected data.

The company says the incident is “contained,” and it does not anticipate the data will be shared or made public.

The government of Newfoundland and Labrador also issued a notice about the data breach at PowerSchool, which it said is used in the provincial education system from kindergarten to Grade 12. It said “multiple government departments” are involved in determining the next steps.

PowerSchool said it is providing services to its customers as usual as it continues to investigate the data breach.

“We take our responsibility to protect student data privacy and act responsibly as data processors extremely seriously,” it said in its statement.

–With files from The Canadian Press