Education boards left gates wide open for PowerSchool mega-breach, say watchdogs

Canadian privacy watchdogs say that school boards must shoulder part of the blame for the PowerSchool mega-breach, not just the ed-tech giant that lost control of millions of student and staff records.

In coordinated findings published this week, the privacy commissioners of Ontario and Alberta said that the December 2024 intrusion was made worse by widespread failings across the education sector. While compromised login credentials let the attackers into PowerSchool's systems, investigators concluded that many school boards hadn't put basic contractual, security, or oversight safeguards in place before handing over student data.

The joint reports land nearly a year after it was revealed that PowerSchool had quietly paid a ransom to criminals who claimed that they had exfiltrated personal data from the company's hosted education platforms. At the time, PowerSchool insisted that the crooks had "deleted" what they stole, but as The Register later reported, extortionists soon ...