Dozens of boards in Alberta and Ontario paid too little attention to the risks in their dealings with edtech provider PowerSchool, the privacy commissioners in the two provinces found. Many boards weren’t ready to respond when a bad actor stole students’ and staff members’ personal data in 2024 by breaking into PowerSchool systems, the commissioners reported after parallel investigations. (The Logic)

Talking point: The breach affected some of the biggest boards in Canada—in Toronto and its suburbs, Ottawa and Calgary. PowerSchool’s security measures were not up to par, the commissioners found, and the boards had legal obligations to make sure they were. Furthermore, the cyberattack hit boards that had left a remote-access function in PowerSchool’s software turned on around the clock. Provincial governments should support school boards’ privacy and cybersecurity measures better, the commissioners said.