Important Notice: PowerSchool Data Breach

All current and former MHPSD students and staff from 2010 and onward.

MHPSDs investigation has determined that the data accessed included:

• Student demographic information such as first name, last name, date of birth, student/guardian home phone numbers, and mailing addresses. 
• Alberta Student Numbers (ASN)
• Guardian details such as first name, last name, email, address, contact alerts and custody orders. 
• Student medical information, including details such as asthma, allergies, diabetes, or other medical conditions that parents shared with the school at the time of registration or reregistration. 
• Although the data breach impacted each school division differently, MHPSD does not collect Social Insurance Numbers (SIN) and/or Alberta Health Numbers as part of student records.

Limited work-related data, including names, email addresses, and internal identification numbers were accessed.  

• MHPSD does not store Social Insurance Numbers (SIN) in the PowerSchool staff record. 

No. Financial information is not stored in PowerSchool, therefore it was not impacted by the data breach. Financial information is defined as bank account numbers, credit or debit card details and financial transaction records. 
 

PowerSchool manages student information as defined above, but when parents or guardians make a payment during registration, they are redirected to SchoolCash Online via a secure link. Data is not shared between PowerSchool and SchoolCash online. 

No. Student and staff photos were not accessed.

No. Personal documents, such as birth certificates and other legal documents uploaded during the registration process are NOT stored in PowerSchool. 

Yes, you can continue to use your PowerSchool account. The PowerSchool cybersecurity incident has not disrupted daily school operations, classroom instruction and will not impact online registration. The incident has been contained and additional security measures have been implemented by PowerSchool to prevent future breaches. Refer to PowerSchool for more information.

The accessed data could potentially be used for identity theft, where personal details are misused to impersonate someone or commit fraud. It could also be used for phishing or social engineering, such as sending fake emails or messages designed to trick individuals into revealing sensitive information like passwords or financial details.

While no financial information, passwords, or personal documents were accessed, it is always important to monitor digital accounts to watch for activity that is not yours.

Be cautious with emails or messages that seem unfamiliar. Avoid clicking on unknown links and refrain from sharing personal details in response to unsolicited requests.

PowerSchool reports that the breach occurred after an unauthorized party used a compromised credential to gain access, affecting information from multiple school divisions worldwide, including Medicine Hat Public School Division.

PowerSchool has reported that the vulnerability has been identified and resolved. They have also implemented enhanced security measures to prevent similar incidents in the future. Please visit PowerSchool for more information. 

This was a PowerSchool breach. PowerSchool reports that it has strengthened its password policies and controls, including increasing the length and complexity of the passwords required of all employees. PowerSchool is working with CrowdStrike, a leading cybersecurity company, monitoring the internet for any potential misuse of data. 

MHPSD is also monitoring this situation closely. MHPSD will continue to work closely with all third party service providers to evaluate their ability to keep our data safe. 

Medicine Hat Public School Division has Multi-Factor Authentication (MFA) enabled for all staff. MFA reduces the risk of account takeovers and provides a necessary additional layer security for users and their accounts. MHPSD maintains a proactive and ongoing commitment to improving cybersecurity measures. We are aware of the dynamic nature of cyber threats and we are dedicated to adapting and evolving strategies to mitigate risks.

Using the following practices will help individuals reduce the risks associated with keeping you and your data safe online: 

• Regularly check email, online accounts, and social media accounts for any signs of unusual activity.
• Update all account passwords frequently, especially if any have been reused across different platforms.
• Use strong, unique passwords for every account, and consider using a password manager for enhanced security.
• Activate two-factor or Multi-Factor Authentication on any accounts where it’s available for extra protection.

Additionally, stay vigilant against phishing attempts. Be cautious of unfamiliar emails, email addresses, calls, or messages that claim to be from legitimate organizations. Never click on suspicious links or share personal information without verifying the source. By taking these precautions, you can help safeguard your accounts and reduce the risk of unauthorized access.

PowerSchool has engaged with TransUnion and Experian, trusted credit reporting agencies, to offer complimentary identity protection and credit monitoring services to all students and staff whose information was involved in the data breach. 

• Identity Protection: PowerSchool is offering two years of complimentary identity protection services, which will be provided by Experian, in Canada and the United States, for all students and staff whose information was impacted.
• Credit Monitoring: PowerSchool will offer two years of complimentary credit monitoring services, provided by TransUnion, for all students and staff (whose information was involved) and have reached the age of majority. This service is being provided by TransUnion because Experian does not offer credit monitoring in Canada.

Please visit Notice of Data Breach For Individuals in Canada | PowerSchool for instructions on how to access identity protection and credit monitoring services being provided by PowerSchool.

All vendor services are provided to us on a contract basis. At the end of each contract cycle we evaluate the partnership and explore alternative vendor options before moving ahead. We consider a variety of factors as part of our decision, security being one of the most important criteria. 

Send us an email communications@sd76.ab.ca