What happened?
On December 28, 2024, PowerSchool, a third-party service provider used by the Superior North Catholic District School Board, became aware of a cybersecurity incident involving unauthorized access to certain PowerSchool Student Information System (SIS) information.
On January 7, 2025, PowerSchool notified us of the incident and that personal information of our students and educators may have been impacted.
Who was affected?
Many public boards and private schools across North America who use PowerSchool SIS were affected by this incident.
What data was compromised?
We have worked with PowerSchool to determine that the following Board information was affected:
For all students who have been enrolled in Superior North Catholic District School Board since 2015, the information affected includes:
- Name (First, Last)
- Date of birth
- Home and/or mailing address
- Gender
- Current grade level
- Student number
- Ontario Education Number (OEN)
For some students, the following additional information was also affected:
- Medical alert notes
- Home phone
- Enrollment arrival and departure dates
- Emergency contact names and phone numbers
- Guardian email
- Parent/guardian custodial status
- Doctor’s name and phone number
- Parents names
- Notes regarding reasons for transferring between schools
With respect to medical alert information, if you provided information to your child’s school about your child’s allergies, medical conditions or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired. Please note that medical information provided to members of Superior North Catholic District School Board’s community partners and external consultant teams (e.g. Psychologists, Occupational Therapists, Physiotherapists, Audiologists, Speech-Language Pathologists, and Social Workers) was not impacted by this incident.
This incident did not compromise any of the following information: financial information, social insurance number (SIN), health assessment information, medical records, student academic grades, IEPs or accommodations.
Educator information:
For all board staff with PowerSchool SIS (educators, administrative assistants, principals and other board support staff) who have worked in Superior North Catholic District School Board since 2019, the information affected includes:
- Full name, employee ID, school(s) of employment, and board email address.
For some staff, the following additional information was also affected:
- Title, Home address information, home phone number
Staff without a PowerSchool SIS account were not impacted.
What steps are you taking to prevent this from happening again?
Although this cyber incident did not take place in a Superior North Catholic District School Board environment, as part of our own investigative process, we are working with industry experts and using this incident as an opportunity to review our vendor retention practices and improve how we protect personal information.
Where can I learn more about the incident?
PowerSchool has posted an FAQ on their website to share information, which includes steps they have taken to address this incident and protect student, family and educator information moving forward.
Visit:
https://www.powerschool.com/security/sis-incident/
Did the Board notify the Office of the Information and Privacy Commissioner?
Yes, the Board has notified and is working with the Ontario Information and Privacy Commissioner in responding to this incident. While you are entitled to file a complaint, the IPC has advised that it is not necessary as they are already investigating the matter. You can visit the IPC’s website at
www.ipc.on.ca.
Was any credit card or banking information involved in this incident?
No. Both PowerSchool and the Board’s own internal investigation can confirm that there is no evidence of any credit card or banking information being compromised.
Is there any indication that compromised information has been released?
PowerSchool has reported that it received confirmation that the data acquired by the unauthorized user was deleted and that the data was not posted online.
Why were you keeping my student data if I was no longer enrolled in the board?
We keep information about former students in accordance with provincial requirements under the Education Act and to respond to former student information requests. We are taking this opportunity to assess our records retention practices to ensure that we are only keeping what is necessary to conduct the Board’s business.
I attended the Superior North Catholic District School Board many years ago. Was my information impacted?
Our PowerSchool SIS stores data for students who attended a Superior North Catholic District School Board school from 2015 onwards. If you were a Superior North Catholic District School Board student prior to this, your information was not impacted as part of this incident.
Can I opt out of PowerSchool?
Not at this time. Superior North Catholic District School Board is using this incident to review the information practices of all of its vendors.
Is the Board changing vendors?
Not at this time.
Were all PowerSchool products impacted?
No. Only PowerSchool SIS was impacted by this incident. Other PowerSchool tools, like SchoolMessenger, were not impacted.
I have additional questions not addressed by these FAQs.
If you have additional questions, please contact us at
[email protected]