Calgary firm launches class-action lawsuit over PowerSchool breach

Court documents allege PowerSchool, a company that manages a student information system, violated the trust of users and did not adequately protect their information. (File)

A class-action lawsuit has been filed against PowerSchool, the organization entrusted with the personal information of thousands of students and families across Canada, following a cyber security breach earlier this month.

• Sign up for breaking news alerts from CTV News, right at your fingertips
• The information you need to know, sent directly to you: Download the CTV News App

Calgary law firm Cuming & Gilespie claims the company, which administers an information system utilized by staff, students and parents at dozens of school boards across Canada, the U.S. and internationally, caused “anxiety and mistrust” in users over concerns their personal information would “be sold or used for nefarious purposes.”

The lawsuit alleges “personal information, when in the hands of an unauthorized party, is capable of being used in a variety of illegal and damaging ways, including, inter alia, identity theft, credit card fraud, land titles and mortgage fraud, and theft.”

“There is a real and substantial risk that the personal information has or may be illegally used.”

On Jan. 7, PowerSchool told officials that its systems were breached on Dec. 28, 2024, by an unknown party.

PowerSchool said that steps were taken to protect student information and a third-party cybersecurity expert was engaged to help deal with the issue.

In it’s notice to school boards, PowerSchool said “the incident is contained” and there was no evidence of malware still within its network.

The affected school boards informed parents that they were also taking steps to protect their systems.

Expenses and changed passwords

The suit claims the users have “suffered damages” because they’ve needed to change all of their passwords, not just with their PowerSchool accounts, but with all of their online accounts associated with the personal information that was stolen.

“The defendants knew or ought to have known that their databases were vulnerable to loss or theft,” the suit claims.

“The defendants had an obligation to properly implement best practices and industry leading security policies, procedures, and systems to protect valuable personal information.”

It also said that PowerSchool used “dated security measures” that failed to detect the breaches when they occurred.

Further, the suit says it “failed to implement policies and procedures or take adequate steps to safeguard” the personal information entrusted into its care.

The class-action seeks damages from PowerSchool for costs incurred or to be incurred by preventing identity theft, mental distress and anguish, out-of-pocket expenses, loss of privacy and invasion of rights among other factors.

The suit seeks a judgement for damages for the above, to be determined later by the court, plus a general and special damages award of $50,000.

Financial information at risk

When CTV News first reported on the PowerSchool breach, the Calgary Board of Education (CBE) said no financial information was stored on the accounts it had with the company.

In an updated statement on Thursday, the CBE told parents it would be offering two years' of credit and identity protection and services for all students and educators whose personal information was exposed.

Those services will be offered through TransUnion, for credit monitoring, and Experian, for identity protection.

“More information on this service will be shared with families in the near future, including how to enroll in identity protection services,” the CBE said in a statement.

“Thank you for your patience and understanding as we work through this complex situation. The protection of student and staff data is important to us and we are taking this security breach seriously.”

The claims in the lawsuit have not yet been tested in court.