Private student information may have been stolen in N.L. school security breach

Cyberthieves may have stolen the information of Newfoundland and Labrador students going back decades — including names, addresses, and MCP numbers. 

The education department says late last month hackers accessed PowerSchool, a data management software used in the province's K-to-12 school system, and accessed information going back to 1995.

In an emailed statement, the education department's media relations manager Lynn Robinson said PowerSchool became aware of a potential cyber security incident on Dec. 28. The company notified the province of the incident on Jan. 7.

"I thought it was very important that we let our schools, our families and our communities know that this has happened," said education minister Krista Lynn Howell on Wednesday.

She said they're working with PowerSchool to figure out what data was accessed in the breach — which includes schools in the province's English, French, Indigenous and private school systems.

Right now, Howell said there isn't a lot of information as an investigation is ongoing. 

"As we move forward to more current students, there may be a little bit more information because it's a platform that we use to communicate sometimes grades and information for families about their students," said Howell.

The privacy breach extends beyond Newfoundland and Labrador, as the PowerSchool platform is used in many jurisdictions across North America.

Howell said PowerSchool has identified how the data was accessed, has shut down the account, reset passwords, and implemented additional security measures. 

The minister also recommends parents reset the passwords on their children's accounts. 

"Cyber security is everybody's responsibility," said Howell. "So [we] encourage parents to take that advice and change their passwords and continue to monitor their accounts."

"We just want to let everybody know that it is still functional. They can still use it and we still have confidence that it's a secure process for the time being and our investigation is ongoing," she said. 

If parents have questions or concerns about the data breach, she said there will be a link with contact information on the education department's website. 

Meanwhile, PC education critic Paul Dinn is concerned about how long it took for the province to notify parents of the privacy breach.