Saskatchewan School Data Breach Highlights Risks of Paying Ransom

A significant data breach affecting the Prairie Spirit School Division (PSSD) has raised concerns about the security of sensitive personal information. According to a report from Grace Hession David, the Saskatchewan Information and Privacy Commissioner (SIPC), the incident involved a ransom demand of 30 bitcoins, which at the time was valued at approximately $2.85 million USD. The hackers threatened to leak the personal information of students, parents, and teachers, unless the ransom was paid.

The breach came to light following the school division’s notification to the SIPC on January 9, 2025. It was reported that 28,635 student records and 4,130 teacher records were compromised, with the total figures including duplicates. Notably, the ramifications of this breach extend beyond Saskatchewan, as court documents reveal that the ransom demand threatened to expose data for “more than 60 million students and 10 million teachers” across multiple jurisdictions.

Contractual Failures and Data Management Issues

The SIPC’s report detailed a series of contractual and operational failures that contributed to the breach. PSSD had started the process of discontinuing its services with PowerSchool in January 2022, requesting the cancellation of its subscriptions. A contract clause stipulated that all data would be “destroyed” following termination, yet the school division did not receive confirmation of this data deletion despite repeated inquiries.

In March 2024, PowerSchool indicated that the server had been “decommissioned,” but PSSD received no definitive timeline for when its data would be fully purged. By September 2024, hackers exploited login credentials belonging to a PowerSchool contractor, gaining access to sensitive data. The subsequent transfer of this information to a server located in Ukraine led to the ransom demand.

PowerSchool acknowledged that it decided to pay the ransom but did not disclose the exact amount or timing. In a statement, a company spokesperson emphasized their commitment to protecting customers and noted that they had enhanced security measures following the incident. Hession David cautioned, however, that the decision to pay a ransom does not guarantee that the stolen data has been secured or deleted.

Recommendations for Future Prevention

The SIPC report underscores the importance of implementing robust security measures to prevent similar breaches in the future. Hession David identified the absence of multifactor authentication as a significant vulnerability. She recommended that PSSD include this requirement in future contracts with service providers to enhance security.

Additionally, the report criticized PowerSchool for its delayed data purging process and highlighted deficiencies in the wording of the contract, which did not meet provincial privacy legislation requirements. PSSD acknowledged that it had not conducted audits of PowerSchool’s practices, despite having a contractual provision allowing for such audits.

Hession David emphasized the need for public bodies to manage and protect data diligently, stating that retaining sensitive information such as Social Insurance Numbers (SIN) and Health Services Numbers (HSN) poses unnecessary risks. She urged PSSD to cease the overcollection of personal information and recommended that they ensure the deletion of any unnecessary records.

The report concluded with a warning that the compromised data may have been sold on the Dark Web, potentially exposing affected individuals to identity theft and fraud. Hession David encouraged those impacted to monitor their credit reports closely.

This incident serves as a stark reminder of the vulnerabilities associated with data management in educational institutions and highlights the critical need for stringent security protocols. Public bodies must remain vigilant in their responsibilities to protect sensitive information, even when outsourcing data management to third-party service providers.