In December 2024, PowerSchool—a widely used student information system (SIS) provider—suffered a major data breach due to compromised credentials, allowing a threat actor to access its student information system (SIS) and customer support portal (PowerSource). The breach exposed personal data of ~5.2 million Canadians, including students, parents/guardians, and staff across eight provinces and one territory, with 3.86 million in Ontario and 700,000+ in Alberta affected. The attacker exfiltrated sensitive records, exploiting an ‘always-on’ remote maintenance feature left unsecured by school boards. Investigations by Ontario and Alberta’s privacy commissioners revealed critical gaps in PowerSchool’s security measures, including lack of multi-factor authentication (MFA), inadequate contract provisions for privacy compliance, and poor breach response protocols among educational bodies. An American college student was later arrested and sentenced to four years in prison for cyber extortion linked to the attack. The incident underscored systemic failures in safeguarding student data, prompting calls for stricter vendor agreements and enhanced oversight.