Listen to this article
Estimated 5 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
The Newfoundland and Labrador department of education did not have the proper tools in place to monitor the personal information stored by PowerSchool — which led to a massive privacy breach in which anyone who was a student or had a child in school from 1995 and onward had their personal information stolen.
The information of teachers, dating back to 2010, was also vulnerable to hackers.
In January 2025, the provincial education department announced it was notified in late December hackers accessed PowerSchool — data management software used in the province’s K-to-12 school system.
The privacy breach extends beyond Newfoundland and Labrador, as the PowerSchool platform is used in many jurisdictions across North America.
The breach impacted 285,158 individuals, which includes current and former students as well as former and current teachers. Information taken includes names, home addresses, MCP numbers, social insurance numbers, medical alert information, and other details.
“This was a significant breach that affected hundreds of thousands of people across the province, many of them children,” said Information and Privacy Commissioner Kerry Hatfield in a media release issued Tuesday.
WATCH | Privacy commissioner calls for action:
Privacy commissioner says laws need to be made to keep companies in check following PowerSchool data breach
Hundreds of thousands of people were left vulnerable after a 19-year-old American accessed sensitive data from PowerSchool. As the CBC’s Leila Beaudoin reports, N.L.’s privacy commissioner says companies need to be held accountable, but the province also needs to better manage its residents’ information.
In an interview with CBC News, Hatfield said the PowerSchool breach was the second-largest cyberattack in the province’s history, after the cyberattack in 2021 on the province’s health authority.
She said in this case, the PowerSchool breach impacted children and youth, who are society’s most vulnerable.
“Public bodies, including like the department of education, have to do a better job to reasonably safeguard our data,” Hatfield said. “They have a legal obligation to protect that data.”
When data is in the hands of third parties, she said there need to be contracts with strong security and privacy provisions. She said in this case, there were clauses but the problem was around follow-up and ensuring contractual obligations to protect privacy.
Hatfield said public bodies have an obligation to make sure contractual obligations are being followed.
Hatfield said third-party vendors have to be held to account, which she said starts in the procurement process, and says people should demand security and privacy be taken seriously by these companies.
Stop collecting MCP info, report says
In total, the MCP numbers of 244,917 from student records were accessed, from both current and former students.
However, those numbers should not have been collected in the first place, according to the privacy commissioner’s report.
“The Department’s collection and retention of student MCP numbers was not authorized under the [Access to Information and Protection of Privacy] Act,” states the overview of the report.
Hatfield’s report comes with recommendations that the Department of Education should review its contract with PowerSchool and its usage of the PowerSchool SIS software. (Laura Meader/CBC)
“As a result, the Report recommends that the Department immediately cease collecting this information and permanently remove existing MCP numbers from student records.”
In addition, Hatfield’s report recommends the department of education directly notify a small group of current students who were identified as potentially having Social Insurance Number (SIN) information affected in the breach.
Hatfield said while many people were directly notified of the breach via a letter, there are about 14 students who might not know if their SIN information had been compromised to date.
The report states the department took “reasonable steps in its response to the breach,” but noted there are areas for improvement.
The report also cited PowerSchool for “its failure to meet [its] commitments in practice.”
The report includes a list of further recommendations for the education department centred around reducing risk, improving accountability and protecting personal information.
It advises the department to review and, if necessary, renegotiate with its contract with PowerSchool regarding the security of personal information and allow the government to demand evidence the contract is being followed.
The report also calls on the province to review PowerSchool’s security policies and procedures to find vulnerabilities that could have caused a breach, ensure that future data collection only uses required fields to limit the chance of unnecessary data collection, and to develop and incorporate a retention and destruction schedule to ensure data doesn’t stay in one place for too long.
“Ultimately this report finds that the department did not implement adequate oversight measures to ensure that PowerSchool was meeting its contractual obligations or maintaining reasonable security measures,” reads the report.
CBC News has asked minister of education Paul Dinn for an interview.
Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Sign up for our daily headlines newsletter here. Click here to visit our landing page.