Dear Staff,
Further to the information shared on January 8, 2025, and today’s earlier message to all staff, we are writing with an update on the cyber incident involving PowerSchool’s Student Information System – the application used by TDSB and many school boards across North America to store certain student information.
What Happened?
As you may recall, on Tuesday, January 7, 2025, PowerSchool notified TDSB and other school boards in Ontario and across North America that a PowerSchool system had experienced a data breach between December 22-28, 2024. TDSB’s cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational. TDSB can confirm that our environment is secure, and that there is no ongoing unauthorized access to any data, either stored in PowerSchool’s Student Information System or elsewhere.
Who Was Impacted?
We are contacting you because we have confirmed that you are an affected individual by this cyber incident.
What Information Was Impacted?
While our investigation into the incident continues, we have now confirmed the types of personal information stored in PowerSchool’s Student Information System that may have been accessed and acquired by an unauthorized user:
- First, Middle & Last Names
- Employee Numbers
- TDSB Email Address
You are being contacted because, in addition to the information above, your Personal Phone Number and/or Home Address were included in PowerSchool’s Student Information System. Please note that TDSB has deleted your Personal Phone Number and/or Home Address from PowerSchool’s Student Information System.
To be clear, TDSB does not store any Social Insurance Numbers, financial or banking information in the PowerSchool Student Information System, so that information was not affected in any way.
PowerSchool has reported that it received confirmation that the data acquired by the unauthorized user was deleted and that the data was not posted online. Nevertheless, TDSB continues to take this incident very seriously, and is working with PowerSchool to ensure an incident like this does not happen again in the future.
This breach has been reported to the Office of the Information and Privacy Commissioner of Ontario (the IPC) and an investigation file has been opened. While you are entitled to file a complaint, the IPC has advised that it is not necessary as they are already investigating the matter. You can visit the IPC’s website at www.ipc.on.ca.
Where Can I Find the Latest Information?
We will continue to provide additional updates as we receive them. Information on this evolving situation is available here on the TDSB’s website. We also recognize that you may have questions about what has occurred. Should you have any questions, please contact cyberincident@tdsb.on.ca.
Sincerely,
Stacey Zucker
Interim Director of Education