School boards hit with ransom demands linked to PowerSchool cyberattack

Canada's largest school board and others across North America have received ransom demands connected to the massive PowerSchool cybersecurity breach that hit during the winter break — this after the company paid hackers a ransom to delete the stolen data. 

Despite assurances that the data was deleted, it turns out that's not the case, the Toronto District School Board (TDSB) said Wednesday. 

The board said in an email to families on Wednesday it had received a ransom demand "from a threat actor" using data from the December 2024 breach. 

Peel District School Board, west of Toronto, and the Calgary Board of Education, the largest in Western Canada, also alerted families about extortion attempts using the data, which was stolen after a PowerSchool administrator account used to provide technical support was compromised. 

School divisions right across Canada — in Alberta, Ontario, Manitoba, Newfoundland and Labrador, Nova Scotia, Northwest Territories, Prince Edward Island and Saskatchewan — primarily use the California company's web-based system to manage student personal, and sometimes medical information, grades and other details. Some use it as a portal to communicate with families.

Different types of data — in some cases going back decades — were accessed in the breach. Depending on the board, that might have included names, birth dates, home address and phone numbers. In other cases, even more personal info such as student identification numbers, gender, medical info and emergency contacts might have been exposed.

The company said Wednesday its decision to pay the ransom had been difficult. The company did not say how much it paid. 

"We believed it to be in the best interest of our customers and the students and communities we serve," the company said in a statement, adding that the new ransom demands have been reported to U.S. and Canadian law enforcement. 

"We sincerely regret these developments — it pains us that our customers are being threatened and re-victimized."

Both the Toronto and Calgary boards again encouraged families to pursue PowerSchool's offer of credit monitoring and identity protection services.

This latest development is a "worst-case scenario come true," technology analyst Carmi Levy said from London, Ont.

"Whenever a ransom is paid, that's the risk you run and unfortunately in this case, they gambled and they lost."

Data — including student information — has high value to cybercriminals, who can combine it with details stolen in other breaches to create a more fulsome package to be used for identity theft or financial attacks, Levy says.

"Even something as innocuous as the address of the home where we grew up or the names of our teachers when we were kids can be used to gain access to other accounts that do matter in the present day, like our bank accounts," he said.