Prairie Spirit School Division is encouraging affected staff and families to continue monitoring their credit and identity information following a cybersecurity breach involving PowerSchool’s Student Information System (SIS).
The incident, which occurred in late 2024, involved unauthorized access to PowerSchool’s systems through one of its customer support portals, PowerSource. Personal information belonging to students and educators; including names, contact details, dates of birth, and in some cases Social Insurance Numbers or limited medical information; was exfiltrated.
PowerSchool has stated that it is not aware of any identity theft linked to the breach; however, the company offered two years of complimentary identity protection and credit monitoring services through Experian and TransUnion. Enrollment for these services closed on July 31, 2025.
Prairie Spirit reported the breach to the Office of the Saskatchewan Information and Privacy Commissioner, which recently released its findings. The Commissioner identified several contributing factors, including the lack of multifactor authentication on PowerSchool’s system, PowerSchool’s failure to delete certain data as required by contract, and Prairie Spirit’s overcollection of sensitive information such as students’ Social Insurance Numbers and Health Services Numbers.
Recommendations from the Commissioner included ensuring future agreements with information management service providers (IMSPs) meet privacy legislation requirements, enforcing multifactor authentication, conducting regular audits, and discontinuing the collection of unnecessary personal data. Prairie Spirit was also urged to advise affected individuals to regularly check their credit reports and scores.
The division emphasized the importance of remaining vigilant and reviewing account statements for any suspicious activity. PowerSchool noted it will never contact individuals to request personal or account information.
