Data stolen during a cybersecurity breach at the Toronto District School Board (TDSB) was not destroyed despite a ransom being paid, the school board has learned.
Student information, that included names, birth dates, health card numbers and medical information, dating back to 1985 was compromised during an cybersecurity incident involving PowerSchool software back in Dec. 2024.
Social Insurance Numbers, and financial or banking information are not stored in PowerSchool so that information was not affected by the breach.
Other GTA school boards were also affected by the data breach.
At the time, PowerSchool told the school boards that the data accessed by an unauthorized user had been deleted and no copies of the data had been posted online.
PowerSchool, the United States-based software company that provides the student information system to schools across North America, confirmed Wednesday that it paid a ransom after the December 2024 breach, in hopes of preventing public release of the stolen data.
“We made the decision to pay a ransom because we believed it to be in the best interest of our customers and the students and communities we serve,” it said in a statement.
“It was a difficult decision, and one which our leadership team did not make lightly. But we thought it was the best option for preventing the data from being made public, and we felt it was our duty to take that action. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us.”
However, earlier this week, TDSB says they were made aware that the data had not been destroyed.
The school board, along with other school boards affected, received communication from “a threat actor demanding a ransom using data from the Dec. 2024 incident.”
In a statement, the board said they “appreciate that this news may be unsettling and understand the concern this may cause.”
They added the board is working with PowerSchool, law enforcement and the Privacy Commissioner of Ontario to provide support.
PowerSchool has also offered two years of complimentary credit monitoring and identity protection services to those affected.
