Canada’s privacy commissioner says he’s launching an investigation into the PowerSchool data breach.
That breach led to millions of current and former students and thousands of staff in the country having their data accessed at the end of December 2024.
In a statement on Tuesday, federal privacy commissioner Philippe Dufresne said he had received a breach report from the company and a complaint as well.
While working to obtain more information, he said he is launching an investigation under the Personal Information Protection and Electronic Documents Act (PIPEDA).
“My immediate focus is on ensuring that the company is taking the necessary steps to address the issue and protect Canadians’ personal information, notably breach containment and measures to reduce risks to those affected, as well as actions to prevent future breaches,” he said.
Dufresne went on to say the company has been notifying Canadians impacted by the breach, with credit monitoring and identity protection services being provided.
Get breaking National news
For news impacting Canada and around the world, sign up for breaking news alerts delivered directly to you when they happen.
He added that his office remains in contact with provincial and territorial privacy counterparts on the matter.
The investigation comes more than a month after the company began to notify PowerSchool users about the data breach, which impacted school boards across most of North America and other countries that PowerSchool serves.
Global News contacted every school board across the country to determine how many were impacted. Of those that responded, at least 87 were affected.
Not all school boards could provide numbers, with some still working with PowerSchool to determine the extent of the breach.
However, of those that did provide numbers, their data showed more than 2.77 million current and former students were confirmed to have been affected. In addition, 35,951 staff including teachers were confirmed impacted, and one Nova Scotia school board confirmed that 3,500 parents’ data was also accessed.
Among the information accessed in Canada, according to PowerSchool, were people’s names, contact information, date of birth, limited medical alert information, and in some cases social insurance numbers.
A class-action lawsuit was launched by Calgary law firm Cuming and Gillespie last month, though lawyer Craig Gillespie told Global News there was “no urgent call to action” for people to get involved at this time as it still needs to be certified.
Notices will go out for people to join once that occurs.
© 2025 Global News, a division of Corus Entertainment Inc.
The PowerSchool data breach is now under a Canadian privacy investigation
