Dear Parents/Guardians/Caregivers,
Further to the information shared on January 8, 2025, we are writing with an update on the cyber incident involving PowerSchool’s Student Information System – the application used by TDSB and many school boards across North America to store certain student information.
This notification applies to all those who were students with TDSB between September 3, 1985 to December 28, 2024. Please note that we will also be posting this letter on our website to notify TDSB’s former students who may be affected.
What Happened?
As you may recall, on Tuesday, January 7, 2025, PowerSchool notified TDSB and other school boards in Ontario and across North America that a PowerSchool system had experienced a data breach between December 22-28, 2024. TDSB’s cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational. TDSB can confirm that our environment is secure, and that there is no ongoing unauthorized access to any data, either stored in PowerSchool’s Student Information System or elsewhere.
What Information Was Impacted?
While our investigation into the incident continues, we have now confirmed the types of personal information stored in PowerSchool’s Student Information System that may have been accessed and acquired by an unauthorized user. The information includes the following:
Students between September 1, 2017 and December 28, 2024
- First, Middle & Last Names
- Date of Birth
- Gender
- Health Card Number
- Grade Level and School Information
- Start/End Date as a Student
- Ontario Education Number
- EQAO Accommodation Information
- Medical Information (ie. allergies, conditions, injuries)
- Home Addresses
- Home Phone Numbers
- TDSB Student Number
- TDSB Email Address
- First Nations, Métis, Inuit Information
- Residency Status
- Principal/Vice Principal Notes (including discipline notes)
With respect to medical information, if you provided information to your child’s school about your child’s allergies, medical conditions or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired. Please note that medical information provided to members of TDSB’s Professional Support Services team (e.g. Psychologists, Occupational Therapists, Physiotherapists, Audiologists, Speech-Language Pathologists, and Social Workers) was not impacted by this incident.
Students between September 3, 1985 and August 31, 2017
- First, Middle & Last Names
- Date of Birth
- Gender
- Health Card Number
- Ontario Education Number
- Home Addresses
- Home Phone Numbers
- TDSB Student Number
- TDSB Email Address
- First Nations, Métis, Inuit Information
This historical student information is kept in PowerSchool’s Student Information System in order to respond to requests for former student records. Parent/guardian/caregiver and emergency contact information (individuals connected to students who were registered from September 1, 2017 and December 28, 2024)
- First, Middle & Last Names
- Home & Mobile Phone Numbers
- Email Addresses
- Relationship to Student
- Home Addresses
To be clear, TDSB does not store any Social Insurance Numbers, financial or banking information in the PowerSchool Student Information System, so that information was not affected in any way.
PowerSchool has reported that it received confirmation that the data acquired by the unauthorized user was deleted and that the data was not posted online.
Nevertheless, TDSB continues to take this incident very seriously, and is working with PowerSchool to ensure an incident like this does not happen again in the future.
This breach has been reported to the Office of the Information and Privacy Commissioner of Ontario (the IPC) and an investigation file has been opened. While you are entitled to file a complaint, the IPC has advised that it is not necessary as they are already investigating the matter. You can visit the IPC’s website at www.ipc.on.ca.
Where Can I Find the Latest Information?
We will continue to provide additional updates as we receive them. Information on this evolving situation is available here on the TDSB’s website. We also recognize that you may have questions about what has occurred. Should you have any questions, please contact cyberincident@tdsb.on.ca.
Sincerely,
Stacey Zucker
Interim Director of Education