Updates and Frequently Asked Questions (FAQ)
Last updated May 8, 2025
Background
On December 28, 2024, PowerSchool became aware of a cyber incident involving unauthorized access to certain PowerSchool SIS information. At that time, PowerSchool advised school boards that data accessed by the unauthorized user had been deleted and was not posted online.
Update (May 8, 2025)
PowerSchool has since informed us that the unauthorized user attempted to contact multiple school districts indicating that they would release the same data accessed in December 2024. PowerSchool believes this is not a new cyber incident, but a continuation of that earlier incident.
At this time, HCDSB has not been contacted by the unauthorized user.
We recognize that this news may be concerning, however PowerSchool has informed us they are working with cybersecurity experts to thoroughly assess this development and have reported it to law enforcement.
PowerSchool continues to remain transparent and responsive as they address this matter. Together, we are monitoring the situation closely and we will continue to collaborate with PowerSchool.
The privacy and security of our students, families and staff remain our top priority.
We will continue to provide updates to our HCDSB community as they become available.
Frequently Asked Questions
The following is a list of frequently asked questions pertaining to this incident. This page will be updated as new information becomes available.
What data was accessed?
We can confirm that limited student and staff information was compromised as a result of this incident. We can also confirm the type of information stored in PowerSchool SIS that may have been accessed by an unauthorized user.
Student Information
For all students enrolled in HCDSB between September 2015 and December 2024, the following student information was accessed during the PowerSchool cyber incident:
- First Name, Last Name
- Ontario Education Number (OEN)
- Gender
- Date of Birth
- Home Address
- Parent Name(s)
- Parent Contact Email and Phone Number
For some students, the following additional information may have also been accessed:
- Medical alert information
- Guardian alert information
- Emergency contact information (Last Name, First Name, Phone Number)
- Scheduled Year of Graduation
- Grade
- Home Room
For a very small number of students, the following additional information may also have been accessed:
- Doctor name and phone number
With respect to medical alert information, if you provided information to your child鈥檚 school about your child鈥檚 allergies, medical conditions or injuries when completing the start of school year forms, this information was included in the data that may have been accessed or acquired.鈥�Please note that medical information provided to members of HCDSB Special Education team (e.g. Psychologists, Occupational Therapists, Physiotherapists, Audiologists, Speech-Language Pathologists, Child Youth Counselors and Social Workers) was not impacted by this cyber incident. 鈥�
With respect to Guardian Alert information, if you provided information about your custodial status to the school through the registration or verification process, this information was included in the data that may have been accessed or acquired
Educator/Staff Information
- First Name, Last Name
- Employee Number
- HCDSB Email
- Ministry of Education Number (MEN)
Were student/staff photographs accessed?
No images/photographs were accessed in this cyber incident.
Was student bussing information accessed?
No student bus route information was accessed in this cyber incident.
What steps have been taken to protect the personal information of students, families and staff?
PowerSchool has posted an FAQ on their website to share information, which includes steps they have taken to address this incident and protect student, family and educator information moving forward. Visit:
Although this cyber incident was not the result of an error on the part of HCDSB, as part of our own investigative process, we are looking at ways to improve our practices to better protect sensitive and confidential information.鈥�
HCDSB staff have reported this incident to the Office of the Information and Privacy Commissioner of Ontario (IPC), and the IPC has opened an investigation file. While individuals affected by this incident are entitled to file a complaint, the IPC has advised that it is not necessary as they are already investigating this matter. Visit the IPC website at: .
This incident has also been reported to the Ministry of Education and Halton Region Police Services.
How do I change my/my child鈥檚 password?
For HCDSB elementary school students, password resets are made through the HCDSB Help Desk. Please visit for self-help or to create a ticket.
For HCDSB secondary school students, please contact your school library for assistance.
How long does my child鈥檚 information remain in this data base? Do you remove it once students have graduated or left HCDSB?
We can remove information that is no longer required to fulfil our school board’s obligations under the Education Act.
For more information, read Notification of the Routine Collection, Use & Disclosure of Student Personal Information.
I attended HCDSB several years ago. Was my information compromised?
Our PowerSchool Student Information System currently stores data for students who attended an HCDSB school from September 2015 onward. If you attended an HCDSB school prior to September 2015, your information was not stored in PowerSchool SIS and could not have been accessed.
Should I notify my bank/financial institution?
Financial information/social insurance numbers were not included in data HCDSB stores in the PowerSchool Student Information System.
Will identity protection services be provided to students and staff?
PowerSchool is offering two years of complimentary (free) identity protection services, provided by Experian, to students and staff whose information was involved.
The identity protection services are offered to:
- Former or current students who attended an HCDSB school between September 2015 and December 2024.
- Staff who were employed by HCDSB between September 2020 and December 2024 and had access to the PowerSchool Student Information System (SIS).
Will credit monitoring services be provided to students and staff?
PowerSchool is offering two years of complimentary (free) credit monitoring services, provided by TransUnion.
The credit monitoring services are offered to:
- Former or current students who attended an HCDSB school between September 2015 and December 2024 and are 18 years of age or older.
- Staff who were employed by HCDSB between September 2020 and December 2024 and had access to the PowerSchool Student Information System (SIS).
Will identity protection and/or credit monitoring services be provided to parents/guardians or emergency contacts?
PowerSchool is not offering聽identity protection or credit monitoring聽services to parents,聽guardians聽or emergency contacts.聽Parents, guardians and emergency contacts mostly did not have sensitive data affected. These services are being offered to those who had more than name and contact information included in the affected data set. 聽聽
NOTE: The deadline for enrolling in the identity protection and/or credit monitoring services is July 31, 2025 at 5:59 UTC.
How do I sign up for identity protection and/or credit monitoring services ?
PowerSchool has posted instructions for signing up for identity protection and/or credit monitoring services on their website .
We have also posted these instructions on our website:
Do parents have the option to 鈥渙pt-out鈥� of PowerSchool?
At this time, pertinent student information is stored in the PowerSchool Student Information System (SIS). There is no option to opt-out as this information is required to facilitate essential school operations and comply with provincial education regulations.
Will HCDSB be changing vendors?
At this time, we are not considering changing vendors.鈥�
PowerSchool is one of the few vendors offering comprehensive student information systems (SIS) solutions, and鈥痺hile even the most robust cybersecurity measures cannot entirely eliminate the risk of a cyber-attack, PowerSchool is acting in good faith with its customers by being transparent and responsive throughout this incident, implementing enhanced security measures to prevent future breaches.鈥�
Were all PowerSchool products/platforms involved in this cyber incident?
No, the only platform affected by this cyber incident was the PowerSchool Student Information System (SIS).
Other PowerSchool products such as SchoolMessenger and SmartFind were not involved in this incident.
How is HCDSB sharing this information with staff and families?
- On January 8, 2025, HCDSB sent an initial notification email to all HCDSB staff and families.
If you are a current HCDSB staff member or a parent/guardian of an existing HCDSB student and you did not receive this email, please contact us at PowerSchoolincident@hcdsb.org.
- On January 13, 2025, a follow up email was sent to HCDSB staff and families of current HCDSB students. This email confirmed that HCDSB was one of the school boards affected by this cyber incident.
If you are a current HCDSB staff member or a parent/guardian of an existing HCDSB student and you did not receive this email, please contact us at PowerSchoolincident@hcdsb.org.
- On January 13, 2025, an initial email was sent to parents/guardians of students not currently attending HCDSB who attended one of our schools between September 2015 and June 2024.
If you are a former HCDSB student or a parent/guardian of a child under 18 who attended an HCDSB school between September 2015 and June 2024 and you did not receive the above-noted email, please contact us at PowerSchoolincident@hcdsb.org
- On January 13, 2025, we posted a statement on our HCDSB website with information about the PowerSchool cyber incident. Read statement.
- On January 15, 2025, we posted a link to the PowerSchool Cyber Incident FAQ on our HCDSB X and Instagram accounts.
- On February 5, 2025, a follow up email was sent to all HCDSB staff, parents/guardians of current students, and parents/guardians of former students who attended an HCDSB school between September 2015 and December 2024. This update provided information about identity protection and credit monitoring services offered by PowerSchool.
If you are an intended recipient of the above-noted email and did not receive this information, please contact us at PowerSchoolincident@hcdsb.org. - On February 5, 2025, we posted an update on our HCDSB website with information about identity protection and credit monitoring. Read statement.
- On May 8, 2025, we sent an email to all HCDSB staff, parents/guardians of current students, and parents/guardians of former students who attended an HCDSB school between September 2015 and December 2024. This update provided information about an unauthorized user contacting multiple school districts indicating they would release the same data accessed in December 2024. The update also confirmed that HCDSB has not been contacted by this unauthorized user.
If you are an intended recipient of the above-noted email and did not receive this information, please contact us at PowerSchoolincident@hcdsb.org.