‘Threat actor’ attempted to extort school boards after PowerSchool breach: CBE

The Calgary Board of Education says PowerSchool paid a ransom following a data breach late last year.

The Calgary Board of Education (CBE) says it’s been told a “threat actor” has been attempting to extort school boards impacted by the breach of staff and student data earlier this year.

In January, student information database provider PowerSchool informed the CBE that its system had been breached.

At first, the CBE said the data it stored was safe, but later determined that the information, which included addresses, dates of birth and medical information had been taken.

Now, in a letter to parents this week, the board said PowerSchool informed them that the individuals involved have been “attempting to extort school boards” with that data.

The CBE was also told that the company paid a ransom to secure the deletion of the data taken by hackers.

• Sign up for breaking news alerts from CTV News, right at your fingertips
• The information you need to know, sent directly to you: Download the CTV News App

A statement from PowerSchool, provided by the CBE, said the decision to pay came from a belief that it was “in the best interest” of its customers.

“It was a difficult one and one our leadership team did not make lightly,” PowerSchool said. “As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that was provided to us.”

The CBE said it has not paid any ransom or contribute to any ransom payment.

There is no information about what school boards may have been contacted by the hackers.

PowerSchool is continuing to offer two years’ of credit monitoring and identity protection services for students and staff who were part of the breach, CBE said.

“Staff and students who have reached the age of majority can apply for credit monitoring services,” officials said.

The CBE has also taken steps to contain the threat, including implementing enhanced cybersecurity measures and retaining cybersecurity experts and an incident response team.