Student data since 2015 was compromised in cyber hack, northern Ont. school board says

A cyber incident in December compromised private information of all students enrolled since September 2015, the Near North District School Board said Friday. (Supplied)

A cyber incident in December compromised the private information of all students enrolled since September 2015, the Near North District School Board said Friday.

The board, which includes schools in communities in and near North Bay, was the victim of a massive data leak that affected schools across the United States and Canada that use the PowerSchool’s Student Information System app to handle data of students and staff.

PowerSchool told the board about the incident Jan. 7.

“Since then, we have been working with PowerSchool and internal and external experts to determine the precise information that was affected,” the board said in a news release Friday.

All students enrolled at the board since September 2015 had their names compromised, their student numbers, enrolment dates, gender, date of birth and home addresses.

The hackers also had access to most of the students' home phone numbers and their doctor’s numbers. And some students had other information compromised, including medical alert information, guardian email addresses, emergency contact information and date of graduation.

For a small number of students, the board said hacked information included the names of their mothers and fathers and summer school information.

“With respect to medical alert information, if you provided information to your child’s school about your child’s allergies, medical conditions or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired,” the board said.

“This incident did not result in the compromise of any of the following information: financial information; health assessment information; student academic grades (marks); students’ individual education plans; accommodations.”

The board has filed a report on the incident with Ontario’s Information and Privacy Commission. The board has a FAQ page set up here and PowerSchool has one here.

The Office of the Information and Privacy Commissioner of Ontario said in addition to the Near North board, the breach also impacted the Toronto, Peel, York, Thunder Bay, Lakehead, Brant Haldimand Norfolk Catholic, Northwest Catholic, Northeastern Catholic and Rainy River district school boards.

Boards in Alberta, Manitoba, Newfoundland and Labrador and Nova Scotia were also affected, as well as students in the U.S. In total, millions of students had private information leaked as part of the cyber incident.