Report released on PowerSchool cyber attack

A new report released on PowerSchool cyber attack, published by DataBreaches[.]Net on 19 November 2025, summarises findings from the Ontario information and privacy commissioner’s investigation into a large breach affecting power school technology used across the province. The incident, which affected millions of Canadians, saw personal information stolen in December 2024 and the company admitted to paying a ransom to recover the information.

The key findings include that PowerSchool failed to include certain privacy and security provisions in its contractual agreements to ensure that educational bodies meet provincial public sector privacy law requirements, and that there were a lack of policies and procedures to monitor and oversee technical and security safeguards, including user access privileges for remote support personnel and the use of multi‑factor authentication.

Additional findings note that remote access to student information systems by PowerSchool’s support personnel was not limited to only what was necessary, and that there were inadequate breach response plans or protocols. According to Ontario IPC investigation report.