Private student information may have been stolen in N.L. school security breach

Cyberthieves may have stolen the information of Newfoundland and Labrador students going back decades — including names, addresses, and MCP numbers. 

The education department says late last month hackers accessed PowerSchool, a data management software used in the province's K-to-12 school system, and accessed information going back to 1995.

In an emailed statement, the education department's media relations manager Lynn Robinson said PowerSchool became aware of a potential cyber security incident on Dec. 28. The company notified the province of the incident on Jan. 7.

"I thought it was very important that we let our schools, our families and our communities know that this has happened," said education minister Krista Lynn Howell on Wednesday.

She said they're working with PowerSchool to figure out what data was accessed in the breach — which includes schools in the province's English, French, Indigenous and private school systems.

Right now, Howell said there isn't a lot of information as an investigation is ongoing. 

"As we move forward to more current students, there may be a little bit more information because it's a platform that we use to communicate sometimes grades and information for families about their students," said Howell.

The privacy breach extends beyond Newfoundland and Labrador, as the PowerSchool platform is used in many jurisdictions across North America.

Howell said PowerSchool has identified how the data was accessed, has shut down the account, reset passwords, and implemented additional security measures. 

The minister also recommends parents reset the passwords on their children's accounts. 

"Cyber security is everybody's responsibility," said Howell. "So [we] encourage parents to take that advice and change their passwords and continue to monitor their accounts."

"We just want to let everybody know that it is still functional. They can still use it and we still have confidence that it's a secure process for the time being and our investigation is ongoing," she said. 

If parents have questions or concerns about the data breach, she said there will be a link with contact information on the education department's website. 

Concerns about announcement delay 

Meanwhile, PC education critic Paul Dinn is concerned about how long it took for the province to notify parents of the privacy breach. 

He also said parents are concerned about what kind of information about their children and their finances hackers were able to access.

Dinn wants both the minister and PowerSchool to put measures in place to prevent security breaches like this in the future. 

"Maybe there should be individuals that are up monitoring this on a regular basis, especially when you're dealing with electronic information that's personal, confidential," said Dinn. 

He said his main concern is ensuring that the platform is safe and is being monitored. 

"In a society where more and more things are online, we need to take bigger and bolder steps to ensure that it is secure."

Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Sign up for our daily headlines newsletter here. Click here to visit our landing page.