The PowerSchool Breach: What Canadian School Boards Should Learn

In early January 2025, a breach at PowerSchool, a widely used student information system, exposed data belonging to students, families, and staff across North America. Several Canadian school boards were caught up in the incident. Attackers reportedly gained access through a compromised support credential rather than a novel exploit, which is a familiar and uncomfortable pattern for defenders.

Why this matters for Canadian organizations

School boards hold sensitive records on minors: names, addresses, and in some cases medical and academic information. Because so many boards rely on the same platform, a single vendor compromise cascaded into a broad regional event. This is the essence of concentration risk, and it applies well beyond education.

The recurring themes

• Credential access remains the path of least resistance. Support portals and vendor accounts often sit outside an organization’s own identity controls.
• Third-party visibility is thin. Most customers had no way to detect misuse of a vendor-side account.
• Data minimization was absent. Historical records that were no longer needed still expanded the blast radius.

Practical steps

You cannot patch a vendor’s environment, but you can shape your exposure. Ask providers whether support and administrative access require phishing-resistant multi-factor authentication. Insist on contractual breach-notification timelines. Review what data you actually send to each platform and whether retention can be shortened. For your own tenant, enable and retain audit logs so that suspicious exports are visible to your team.

Takeaway

Vendor breaches are your incidents too. Map your critical SaaS providers, demand strong authentication on their privileged access, minimize the data you entrust to them, and keep your own logs so you are not blind when someone else is compromised.