The Office of the Information and Privacy Commissioner (OIPC) of Alberta gave an update about what her office is doing about the PowerSchool widespread data breach that occurred in late 2024 that affected school boards across Alberta.
Wolf Creek Public Schools and Wetaskiwin Regional Public Schools were both impacted by the breach.
As of Feb. 13, 2025, the OIPC had received 31 breach notices about unauthorized access to personal information of students from Alberta educational institutions that were using PowerSchool. In some cases, the personal information of educators was also mentioned.
“I take the privacy rights of Albertans, and in particular children, very seriously,” said Information and Privacy Commissioner Diane McLeod in a press release.
“We are in the beginning stages of our review of these breach notices and will be working with the affected educational institutions to mitigate the risks to those affected by the breach."
The OIPC works independently of government and the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s three access to information and privacy laws.
"We are reviewing the breach notices as they come in to determine the total number of Albertans affected, but it is clear that it is a significant number, including many students. I am also working with my counterparts throughout Canada to address this breach," said McLeod.
The data breach, which occurred between Dec. 22 and 28, 2024, impacted school boards in multiple provinces.
PowerSchool is a U.S.-based, cloud software platform used by by students, educators and educational institutions around the globe.
In a statement, PowerSchool said it had taken "all appropriate steps to prevent further unauthorized access or misuse of the affected data."
According to one breach notice received by the OIPC, the personal information of students that was accessed included names, phone numbers, dates of birth, genders, grades, school-issued email addresses, Alberta student ID numbers, and school-issued ID numbers.
The health-related information consisted of information about allergies, medication and medical conditions, as well as personal health number, physician contact information and guardian information.
On Feb. 3, PowerSchool announced it's offering two years of complimentary identity protection services through Experian to students and educators whose information was involved.
"For those Albertans who received a notice about the breach and have questions, please contact the educational institution that provided the notice to you," stated the release.
"For information about your rights under Alberta’s privacy laws, please visit the OIPC’s website."
