On January 7, 2025, the Provincial Government received notice that PowerSchool had experienced a cybersecurity incident. PowerSchool is a third party which provides a platform used in the provincial K-12 education system, as well as many other jurisdictions.
This page provides key information, Frequently Asked Questions (FAQ), and other resources to help explain what happened, what we know so far, and where we are in the investigation process.
Updates and information will be shared on this page as they become available. Please check back regularly for the most recent developments.
Information on the incident is also available on the PowerSchool website.
Current Incident Update
Public Advisory – February 20, 2025
The Provincial Government is providing an update on correspondence that is currently being sent by PowerSchool to those affected by the cybersecurity incident in the PowerSchool platform.
Individuals affected by the cybersecurity incident are advised that if you have received a notification from Ps-sis-incident@mail.csid.com, Ps-sis-incident@mail1.csid.com and Ps-sis-incident@mail2.csid.com titled “PowerSchool Cybersecurity Incident,” please be aware that it is an official email from PowerSchool. This email may have been delivered to your Spam/Junk folder and is not a phishing scam.
PowerSchool is offering two years of complimentary identity protection services for all students and educators whose information was accessed, and two years of complimentary credit monitoring services to all individuals whose information was accessed and have reached the age of majority. The Provincial Government encourages both current and former students and staff to sign up through the PowerSchool website. PowerSchool will offer these services regardless of whether the individual’s SIN was involved.
The incident is not specific to Newfoundland and Labrador. PowerSchool notified customers in multiple jurisdictions in North America.
A webpage has been set up on the Government of Newfoundland and Labrador’s website with public information related to the PowerSchool incident. All inquiries can be sent to PowerSchoolinfo@gov.nl.ca.
Public Advisory – February 4, 2025
The Provincial Government has received notification from PowerSchool that credit monitoring and identity protection services are now activated and available for students and educators whose information was involved in the recent cybersecurity incident.
PowerSchool has engaged Experian and TransUnion, trusted credit reporting agencies, to provide complimentary identity protection and credit monitoring services to involved students and educators.
Individuals can visit the website here for information on how to activate the complimentary credit monitoring and identity protection services.
In the Newfoundland and Labrador K-12 education system, high school students since 1995 and teachers since 2010 may be eligible to access the complimentary credit monitoring and identity protection services. Individuals are encouraged to visit the above website and follow the prompts to determine eligibility and sign up for the complimentary services.
In the coming weeks, Experian (on behalf of PowerSchool) will also be distributing direct email notifications to involved students (or the parents/guardians of students, as applicable) and educators for whom they have sufficient contact information. The email notice will include further information about the information of theirs involved and the resources PowerSchool is offering.
Additionally, PowerSchool has coordinated with Experian to set up a toll-free call centre for families and educators. Individuals can call (833) 918-9464, Monday through Friday, 10:30 a.m. through 10:30 p.m. NT.
A webpage has been set up on the Government of Newfoundland and Labrador’s website with public information related to the PowerSchool incident. Inquiries can be sent to PowerSchoolinfo@gov.nl.ca.
Public Advisory – January 28, 2025
The Provincial Government is providing an update on actions it has taken to date to address the cybersecurity incident in the PowerSchool platform. The incident is not specific to Newfoundland and Labrador. PowerSchool notified customers in multiple jurisdictions in North America.
Based on information from PowerSchool and work undertaken by the Provincial Government to date, as of this time it has been determined that the following groups of individuals and data have been impacted in the PowerSchool incident:
Teachers: Data relating to approximately 14,400 teachers was accessed by the unauthorized party. The oldest teacher records involved were from 2010. About 70 per cent of the teacher information involved includes some combination of name, email address, and phone number. A small number of Medical Care Plan (MCP) numbers and 749 Social Insurance Numbers (SIN) of teachers were included in the data that was accessed. The Department of Education will provide individual notifications to the 749 individuals who had a SIN involved beginning this week.
Students: Data relating to approximately 271,000 students was accessed by the unauthorized party. The oldest student records involved were high school students’ information from 1995. Approximately 75 per cent of the students whose data was accessed are no longer in the K-12 system. In addition to the individual’s name, information accessed may include contact information, date of birth, MCP numbers, medical alert information, custodial alert information, and other related information. Analysis of student data is ongoing and further updates will be provided as information becomes available.
The Government of Newfoundland and Labrador is working with PowerSchool on notification processes and the ongoing investigation. Updated information will be provided as it becomes available.
PowerSchool will offer two years of complimentary identity protection services for all students and educators whose information was accessed, and two years of complimentary credit monitoring services to all individuals whose information was accessed and have reached the age of majority. PowerSchool will offer these services regardless of whether the individual’s SIN was involved. Further information on credit monitoring and identity protection services will be provided in the coming weeks.
A webpage has been set up on the Government of Newfoundland and Labrador’s website with public information related to the PowerSchool incident. All inquiries can be sent to PowerSchoolinfo@gov.nl.ca.
Media Availability – January 8, 2025
The Honourable Krista Lynn Howell, Minister of Education, was available to the media at 12:45 p.m. on January 8, 2025 to discuss the incident.
Public Advisory – January 8, 2025
On January 7, 2025, the Provincial Government received notice that PowerSchool had experienced a cybersecurity incident. PowerSchool is a third party which provides a platform used in the provincial K-12 education system, as well as many other jurisdictions.
The incident is not specific to Newfoundland and Labrador. PowerSchool notified customers in multiple jurisdictions in North America.
The Provincial Government is working with the vendor to determine the extent of data accessed and number of individuals who may be involved. There has been no disruption to the daily operations of schools or classroom instruction.
PowerSchool has stated that they do not anticipate the data involved being shared or made public, and they believe it has been deleted without any further replication or dissemination. The company has indicated that the incident has been contained and they have increased security within their systems to prevent further incidents.
PowerSchool has stated that it does not expect any misuse of personal information or financial harm to impacted individuals as a result of this incident. They will be providing credit monitoring services to affected adults and identity protection services to affected minors in accordance with regulatory and contractual requirements. More information will be provided on these services and eligibility when available.
Multiple government departments are involved to determine next steps, and the Office of the Information and Privacy Commissioner has been notified. While the investigation is ongoing and information received from PowerSchool may change, the Provincial Government will provide further information as it becomes available. A webpage will be established on the Government of Newfoundland and Labrador’s website with public information. At this time, all inquiries can be sent to PowerSchoolinfo@gov.nl.ca.
Frequently Asked Questions
What happened?
On January 7, 2025, Government received notice that PowerSchool had experienced a cybersecurity incident. PowerSchool is a third party which provides a platform used in the provincial K-12 education system The incident is not specific to Newfoundland and Labrador. PowerSchool notified customers in multiple jurisdictions in North America.
PowerSchool has confirmed that an unauthorized party gained access to certain PowerSchool Student Information System (SIS) customer data using a compromised credential.
PowerSchool has confirmed that only PowerSchool SIS data was accessed and that no other PowerSchool products were affected.
There has been no disruption to the daily operations of schools or classroom instruction.
Who is impacted?
Teachers: Data relating to approximately 14,400 teachers was accessed by the unauthorized party. The oldest teacher records involved were from 2010.
Students: Data relating to approximately 271,000 students was accessed by the unauthorized party. The oldest student records involved were high school students’ information from 1995. Approximately 75 per cent of the students whose data was accessed are no longer in the K-12 system.
What information was accessed?
Teachers: About 70 per cent of the teacher information involved includes some combination of name, email address, and phone number. A small number of Medical Care Plan (MCP) numbers and 749 Social Insurance Numbers (SIN) of teachers were included in the data that was accessed. The Department of Education will provide individual notifications to the 749 individuals who had a SIN involved beginning this week.
Students: In addition to the individual’s name, information accessed may include contact information, date of birth, MCP numbers, medical alert information, custodial alert information, and other related information. Analysis of student data is ongoing and further updates will be provided as information becomes available.
When was the Provincial Government made aware?
The Department of Education was notified by PowerSchool on January 7, 2025.
Was this a targeted incident to our province?
No. This incident impacted PowerSchool customers in multiple jurisdictions in North America.
Has the data accessed been used inappropriately?
PowerSchool has stated that they do not anticipate the data being shared or made public, and they believe it has been deleted without any further replication or dissemination.
What steps are being taken to avoid further incidents?
PowerSchool advises it has contained the incident, including:
- It has deactivated the compromised credential and restricted all access to the affected portal;
- Conducted a full password reset; and,
- Further tightened password and access control for all relevant accounts;
Government is:
- Working with PowerSchool to understand more details about the incident, including the extent of information involved.
What support will be provided to impacted individuals?
While PowerSchool has stated that it does not expect any misuse of personal information or financial harm to impacted individuals as a result of this incident, they are providing credit monitoring services to affected adults and identity protection services to affected minors in accordance with regulatory and contractual requirements.
How can I access credit monitoring or identity protection services?
PowerSchool has engaged Experian and TransUnion, trusted credit reporting agencies, to provide complimentary identity protection and credit monitoring services to involved students and educators.
Individuals can visit the website here for information on how to activate the complimentary credit monitoring and identity protection services.
In the Newfoundland and Labrador K-12 education system, high school students since 1995 and teachers since 2010 may be eligible to access the complimentary credit monitoring and identity protection services. Individuals are encouraged to visit the above website and follow the prompts to determine eligibility and sign up for the complimentary services.
How do I know if my data was accessed?
In the coming weeks, Experian (on behalf of PowerSchool) will be distributing direct email notifications to involved students (or the parents/guardians of students, as applicable) and educators for whom they have sufficient contact information. The email notice will include further information about the information of theirs involved and the resources PowerSchool is offering.
The Department of Education will provide individual notifications to the 749 individual teachers who had a SIN involved in the breach.
How will the public receive updates?
Information will be made available to the public through the media and regular communications channels, as well as to school communities through schools. You are encouraged to check this website frequently for the most up-to-date information.
Information on the incident is also available on the PowerSchool website.
I am a parent or student. How do I change my PowerSchool password?
Instructions on how to change your password are available here.
Was this ransomware?
PowerSchool has stated that this incident was not ransomware.
Was the Rycor payment platform accessed?
The Rycor payment platform is not a PowerSchool product. Information contained in Rycor was not accessed in this cybersecurity incident.
Is this incident related to the text message scam related to driver’s licenses in the province?
No. These incidents are unrelated.
Who can I contact for further information?
Inquiries can be sent to PowerSchoolinfo@gov.nl.ca
If the cybersecurity breach was within the PowerSchool Student Information System, how was some teacher data accessed?
A minimal amount of teacher data is included in PowerSchool’s Student Information System for operational requirements.
Why was student data from 1995 onwards stored in the PowerSchool Student Information System?
PowerSchool is the platform that the Provincial Government uses to store student records for the K-12 school system in Newfoundland and Labrador. The retention of student records is in accordance with the Schools Act, 1997, which establishes legislative requirements guidelines for maintaining educational records. These requirements ensure that student information is retained for necessary administrative, legal, and historical purposes.
I am a former student or my child is currently a student; can my/their student data be removed from PowerSchool?
PowerSchool is the platform that the Provincial Government uses to store student records for the K-12 school system in Newfoundland and Labrador. This data is subject to legislative requirements in accordance with the Schools Act, 1997 and cannot be deleted or removed at this time. A portion of student data is removed after the student leaves the K-12 school system, however basic records, including high school transcripts, is retained.
Is the PowerSchool server hosted in Canada?
Yes, the PowerSchool server is hosted in Canada.
I am concerned that I am a part of a phishing scam. What do I do?
If you believe you have been involved in a scam, report it immediately to the Royal Newfoundland Constabulary at 709-729-8000 or use the online reporting system. Incidents should also be reported to the Canadian Anti-Fraud Centre at 1-888-495-8501.