Ontario and Alberta watchdogs fault school boards over PowerSchool breach

The privacy commissioners of Ontario and Alberta released parallel investigation reports on Nov. 17 that found school boards affected by the 2024 PowerSchool cyberattack did not take reasonable measures to protect the personal information of students and staff.

The findings matter well beyond the two provinces. They place responsibility for a vendor's security failure squarely on the public institutions that hired it, and they set out what regulators now expect of any school, hospital or municipality that hands personal data to a software provider.

What the commissioners found

The incident touched more than 50 schools and school boards and the records of more than 5.2 million people, according to a summary of the reports by law firm Torkin Manes. Some of the country's largest boards, in the Toronto area, Ottawa and Calgary, were among those affected, The Logic reported.

The Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner of Alberta identified several shared failings:

• Contracts with PowerSchool lacked privacy and security terms the law requires, including limits on collection and use, breach notification duties and adequate audit rights.
• Boards did not adequately monitor the vendor's security controls, including remote support access and the use of multi-factor authentication.
• Some boards had left a remote-access function in the software switched on around the clock.
• Access for subcontractors was not revoked or changed within a reasonable time.
• Some institutions collected more data than they needed and kept it too long because they had no retention or deletion policies.
• Many lacked formal breach response plans, which slowed containment and notification.

The commissioners also said PowerSchool's failure to use multi-factor authentication was a flaw in its security posture and a contributing factor to the root cause of the attack.

Recommendations

The reports recommend that institutions review and renegotiate their agreements with technology providers so they meet provincial public sector privacy law, monitor vendors' safeguards against legal and industry standards, limit remote access to systems to when it is actually needed, and put multi-factor authentication and breach response procedures in place.

The commissioners also called on their provincial governments to give boards more support and training, so that schools can negotiate with education technology companies in a more co-ordinated way rather than one board at a time.

What it means for other public bodies

The reports reinforce a principle Canadian regulators have stated for years: outsourcing a service does not outsource accountability for the data. Any public body that relies on a cloud vendor for student, patient or client records should be able to show it has read the contract's security terms, knows who can reach the data remotely and has tested how it would respond if the vendor were breached.

What to do

• Inventory vendors that hold personal information and check whether contracts include breach notification, audit and data-limitation clauses.
• Confirm that vendor support accounts require multi-factor authentication and that remote access is turned off when not in use.
• Set retention schedules so old student and staff records are deleted on time.