N.L. privacy commissioner faults education department over PowerSchool breach

Newfoundland and Labrador’s education department failed its legal duty to protect personal information exposed in the PowerSchool cyberattack, the province’s privacy commissioner has found, recommending that it stop collecting student health-card numbers and purge those numbers from its records.

Commissioner Kerry Hatfield’s May 11, 2026 report, P-2026-001, found inadequate safeguards under section 64(1) of the Access to Information and Protection of Privacy Act, 2015. Weak contractual protections and insufficient monitoring of the technology provider left the Department of Education and Early Childhood Development accountable for a breach affecting 285,158 current and former students and teachers.

The investigation produced 17 recommendations addressing vendor oversight, unnecessary information, retention and notification. It also found much of the department’s response reasonable, while identifying gaps in direct notices to some current students and public communications about who was affected. The department head was required to give the commissioner a written decision on the recommendations within 10 business days of receiving the report.

Older records widened the breach

The attack reached the province’s PowerSchool student-information database through PowerSource, the company’s customer-support portal. Compromised contractor or subcontractor credentials allowed access to student and teacher data. An independent cybersecurity specialist retained by the government confirmed access to Newfoundland and Labrador’s data between December 20 and 22, 2024.

The affected records included information about 270,812 current and former students and 14,346 current and former teachers. Student records dated to 1995, after older high-school certification data were imported during a later consolidation. Teacher records dated to 2010. Family and emergency-contact information also appeared in student records.

The information varied by person and included identification and contact details, health-card numbers and sensitive medical, custodial or disciplinary alerts. The department controlled the contract and the single system used across public, francophone, private and Indigenous schools, which is why the investigation focused on it.

PowerSchool itself was outside the provincial commissioner’s direct jurisdiction under the Act. The report drew on the department’s evidence and investigations by other privacy commissioners when assessing the company’s practices and the department’s responsibility.

Contract promises needed active oversight

The department’s system had a remote-maintenance connection set to remain continuously available. It told investigators it had not understood that this created persistent access between PowerSource and its database. The connection was subsequently disabled.

The report identified inadequate authentication and other security weaknesses. It also found that PowerSource had been excluded from external security assessments and penetration testing. The department was unaware of that exclusion and did not provide evidence that it monitored compliance with the security measures in its contract.

That contract combined several agreements and lacked adequate provisions on safeguards, compliance with provincial privacy law and enforceable access to evidence such as audit reports. It also left gaps around legally compelled disclosures and standards for data described as de-identified.

Hatfield recommended renegotiating privacy, security and enforcement terms, with an interim addendum if necessary. The department should limit remote support to the time needed, review PowerSchool’s security policies, document its monitoring, obtain compliance evidence annually and enforce contractual obligations when they are not met.

The findings went beyond weak wording: other jurisdictions with stronger agreements were also affected. The commissioner emphasized that public bodies must verify whether suppliers actually deliver the safeguards they promise.

Health-card collection lacked authority

The breach exposed 244,917 student Medical Care Plan numbers, most attached to inactive accounts. Schools had continued collecting them even after unique student identifiers replaced health-card numbers as identifiers.

The department initially cited medical emergencies and vaccination coordination. It later clarified that the numbers were no longer needed for vaccination programs. Newfoundland and Labrador Health Services told investigators that emergency medical services would not be denied because someone lacked an MCP card or number.

The department acknowledged that the emergency rationale might no longer apply, but wanted more time to consider possible public-health and research uses. Hatfield found that potential usefulness to another organization did not establish lawful authority for the department to collect the information.

The Schools Act’s power to direct how student records are maintained did not expressly authorize collecting MCP information, as section 61(a) of the privacy law required. Nor had the department demonstrated necessity for its educational programs or activities under section 61(c). The commissioner therefore rejected both statutory grounds advanced for collection.

The recommendations were to stop collecting, using and disclosing student MCP information and to destroy and purge it from all student records, including PowerSchool, other electronic systems and paper files. Hatfield said express legislative amendments would be required if the department wanted authority to collect it.

Too much information, too few retention rules

The department’s privacy impact assessment omitted teacher information and risks created by open text fields, where staff could enter unnecessary sensitive details. Investigators found information that had been entered or collected in error.

Hatfield recommended reviewing every open text field, converting necessary fields to standardized dropdowns, locking nonessential fields and removing unnecessary information. The privacy assessment should reflect teacher data, current student-information practices and the risks of free-form entries.

There was also no comprehensive retention and destruction framework for student and teacher information in PowerSchool. The commissioner recommended policies covering all such records, with appropriate vendor obligations. The department had reported some deletions and field restrictions, but broader information-management work remained underway when the report was issued.

Reasonable response, but notification gaps

The government learned of the incident on January 7, 2025 and notified the commissioner and education partners the following day. Hatfield endorsed the initial public communications, the use of independent experts to verify the vendor’s forensic findings and the department’s continuing risk assessment.

Reasonable containment steps did not establish that stolen information was safe. PowerSchool paid a ransom, but some data later supported fresh extortion attempts elsewhere. The department found no evidence of comparable demands directed at Newfoundland and Labrador schools; the commissioner nevertheless found the breach was not fully contained.

Given the scale of the incident and outdated contact details for former students and teachers, Hatfield accepted primarily public notices supplemented by risk-based direct notices. But parents or guardians of current students whose records contained potential social insurance numbers should have been contacted directly. The numbers were possible SINs, not confirmed ones.

In the communications reviewed for the report, public notices risked suggesting that everyone affected would receive an individual message. The commissioner recommended explaining clearly who would not receive direct notice and why, and updating the webpage and FAQ, which were outdated at the time.

Changes announced after the report

In its May 13 response, the government said work included cybersecurity training, reviewing PowerSchool data, updating retention and deletion arrangements, and reviewing and implementing additional security controls. It said it would examine the report in detail.

NLSchools then announced on May 26 that registration for KinderStart in 2026 and kindergarten in 2027 in the former Avalon region would be postponed until September 2026. It linked the delay to updating registration programming following the recommendation to stop collecting MCP numbers. Families registered earlier in May in other regions would be contacted about those numbers no longer being used, the notice said.

The government’s current incident FAQ, reviewed on October 29, now acknowledges that the stolen information was not deleted and that enrollment for the offered credit-monitoring and identity-protection services has expired. It also explains why the department did not directly notify former students and says the department and the Office of the Chief Information Officer will implement the recommendations.

Hatfield also recommended obtaining evidence of PowerSchool’s work under its commitments to the federal privacy commissioner. The department’s responsibility extended beyond accepting assurances: it needed the contractual tools and ongoing checks to verify how information entrusted to its supplier was protected.