Business Solution Consultant

Government responsible for ensuring companies live up to privacy protection measures: privacy commissioner. May 13, 2026 | 10:43 AM The province's privacy commissioner says the onus is on government to ensure that companies they deal with live up to their contractual obligations in privacy protection. Kerry Hatfield yesterday released her report on the cyber attack involving PowerSchool, and the actions of the public bodies responsible for safeguarding personal information. The PowerSchool cyber attack, which involved jurisdictions across North America, was the province's second largest privacy breach, affecting some 285,000 Newfoundlanders and Labradorians. Hatfield says it's not enough to leave it to the company to ensure that the appropriate privacy procedures are in place and that personal information is protected, it's up to the public bodies involved to ensure that a company is living up to its obligations. "I have kids in school myself, and we're reliant on the department to ensure these security measures are in place. But I think one of the key findings I want people to be aware of is that it's not just what's in the contract, is that the follow-up has to happen. There has to be really strict, systematic monitoring to verify that these big tech companies are actually not just saying they're going to do something in a contract, but they're actually doing it." The provincial government meanwhile says it is taking "proactive steps" to safeguard against future privacy breaches and "ensure stronger cyber protection" for users of PowerSchool. They include enhancing cybersecurity training for all departmental staff, reviewing all data held within PowerSchool, updating a retention and deletion schedule for personal information store in PowerSchool and reviewing and implementing additional security controls.

PowerSchool data breach: what happened and what families should do | Security.org. Source originally from "PowerSchool data breach: what happened and what families should do | Security.org" by Security.org - view original. Educational vendor breach exposes systemic governance failure in K-12 supply chain risk management. Why this matters at the governance level. The PowerSchool data breach of December 2024 - affecting 62 million students and 9.5 million teachers across North America - is not primarily a technology failure. It is a governance failure. School districts, operating under constrained budgets and competing operational priorities, deployed a mission-critical vendor without contractual security baselines, audit rights, or subcontractor visibility. When PowerSchool's own third-party dependencies were compromised, districts had no contractual mechanism to enforce remediation, demand transparency, or recover damages. This incident exposes a structural weakness in how public institutions manage vendor risk: procurement focuses on cost and functionality; security governance is treated as optional. The attack vector reveals absent contractual controls. The breach mechanics are instructive. An attacker obtained credentials from a PowerSchool subcontractor, then accessed PowerSource - PowerSchool's customer support portal - without multi-factor authentication. This portal granted administrative access to student information systems across thousands of school districts. The attacker then systematically exfiltrated databases from December 19-28, 2024, before PowerSchool detected the intrusion on December 28 when the extortion demand arrived. From a vendor risk governance perspective, this sequence reveals three critical failures. First, PowerSchool did not enforce MFA on administrative tools - a control standard for over a decade. Second, PowerSchool maintained "always on" remote maintenance access without adequate logging or detection mechanisms. Third, school districts had no contractual right to audit PowerSchool's security posture, subcontractor vetting practices, or access control architecture. Most educational procurement agreements lack provisions requiring vendors to implement specific security baselines or to disclose third-party dependencies. Districts negotiated with PowerSchool but exercised zero visibility into the vendor's own supply chain. Regulatory and liability exposure compounds the governance gap. Educational records fall under the Family Educational Rights and Privacy Act (FERPA), which imposes obligations on educational institutions to protect student data. However, FERPA does not explicitly require institutions to conduct vendor due diligence or to include security mandates in contracts. This creates a regulatory blind spot: regulators investigating the breach will examine whether districts met their FERPA obligations, but the contractual mechanisms to enforce vendor compliance were absent. The Texas Attorney General's lawsuit against PowerSchool alleges negligence and failure to implement basic security features - including MFA and encryption - despite marketing claims of "highest security standards." This creates secondary liability exposure for school districts themselves. Regulators and plaintiffs' counsel will examine whether districts conducted independent security assessments before deployment, whether procurement processes included security baseline verification, and whether contracts mandated audit rights. Districts that cannot demonstrate contractual security obligations or evidence of vendor vetting face regulatory scrutiny and potential liability for negligent vendor selection. The exposure of bus stop information and transportation routes adds a physical safety dimension that regulators will scrutinize. This is not merely identity theft risk; it is child safety risk. Procurement and governance frameworks must reflect this elevated threat profile. The ransom payment and ongoing extortion reveal contractual gaps. PowerSchool paid approximately $2.85 million in Bitcoin to the attacker. The payment did not resolve the incident. By May 2025, attackers were sending ransom demands directly to individual school districts, threatening to release the same stolen data. This second wave of extortion demonstrates a critical governance failure: PowerSchool had no contractual obligation to coordinate breach response with downstream customers, to provide timely scope reporting, or to cover costs associated with extortion attempts. School districts absorbed operational costs, notification expenses, credit monitoring services, and reputational damage - none of which were contractually recoverable from the vendor. Most educational vendor agreements lack provisions requiring vendors to fund breach response, coordinate notification timelines, or indemnify customers for downstream extortion. The incident should trigger comprehensive contract review: vendor agreements must include explicit breach notification obligations, cost-sharing provisions, and indemnification clauses. Cybersol's governance perspective: structural weaknesses in educational procurement. Educational institutions prioritize cost and functionality during vendor selection but systematically deprioritize security baseline verification and contractual enforcement. School districts often lack in-house technical expertise to evaluate vendor security claims independently. Procurement processes do not mandate pre-deployment security assessments. Contracts do not include audit rights, subcontractor disclosure requirements, or security baseline mandates. Vendor risk monitoring is episodic rather than continuous. The PowerSchool incident should catalyze systemic change in educational procurement governance. Districts must establish vendor security baseline requirements as non-negotiable procurement criteria. Contracts must include explicit security obligations (MFA, encryption, access controls, logging), audit rights, subcontractor disclosure requirements, and breach notification coordination provisions. Districts should require vendors to maintain cyber insurance and to provide evidence of annual security assessments. Ongoing vendor risk monitoring should be formalized, with quarterly security posture reviews and incident response testing. Educational institutions also face a regulatory inflection point. As state-level data protection laws expand and FERPA enforcement intensifies, regulators will examine whether districts conducted adequate vendor due diligence. Procurement decisions that lack documented security assessment will be viewed as negligent governance. Districts should document vendor selection criteria, evidence of security evaluation, and contractual security obligations in procurement files. Attribution and Source. Original Author: Gene Petrino, Home Security Expert, Security.org Source URL: https://www.security.org/identity-theft/breach/powerschool/ Publication Date: Last updated March 31, 2026 Closing reflection. The PowerSchool breach is a watershed moment for educational vendor governance. The incident demonstrates that vendor risk management cannot be delegated to procurement departments operating under cost constraints. Board-level oversight, contractual security mandates, and ongoing vendor monitoring are now regulatory expectations, not optional governance enhancements. Organizations should review the original Security.org article for detailed incident timeline, victim impact data, and family remediation guidance. Governance teams should use this incident as a catalyst for comprehensive vendor risk assessments, contract review, and procurement process redesign.

Naviance owner reaches $17.25 million settlement in privacy lawsuit. April 16, 2026 PowerSchool Holdings LLC, owners of the Naviance platform, have reached a $17.25 million settlement in a class action lawsuit filed regarding student data privacy. The Plaintiff, Q.J., alleges that PowerSchool conducted "non-consensual interception of students' confidential and sensitive communications while using education technology products." Because the Court has not determined a winner in the case, a settlement was reached. Many parents have received communication from Kroll Settlement Administration LLC regarding claim eligibility. Students who have accessed Naviance at least once between Aug.18, 2021 and Jan. 23, 2026 are eligible to receive part of the settlement and are deemed part of the "Settlement Class." The allotment of money each student will receive is determined by the number of claims filed. When the final determination is made by the court regarding the settlement, Powerschool will form a "Web Governance Committee" to ensure student data is managed appropriately within the legal framework. "Additionally, while continuing to deny liability, PowerSchool agrees that for the next two years, it will not use within the Naviance Platform any software, technology and/or code offered or provided by any third party, including but not limited to (a) Heap Inc.; (b) Google LLC; (c) Microsoft Corporation; (d) Hotjar Inc.; and (d) Gainsight, Inc., unless the Web Governance Committee determines that such use is consistent with applicable law at that time," according to the settlement site. To further comply, all data of the Settlement Class that is held by corporations a-d must be deleted. Former Naviance owners Heap Inc. will also be required to delete all primary and backup data held on the Settlement Class. Claims forms may be made by July 27, 2026 via the Kroll Settlement Administration. Additionally, members of the Settlement Class and their guardians can exclude themselves from the settlement by July 13, 2026 to retain suing rights. The same date serves as the deadline to write an objection towards the settlement. A hearing will occur on Aug. 19, 2026 at 11 a.m. where people can request to speak on the settlement. All information and quotations used to develop this article, as well as additional information, can be found at powerschoolnaviancesettlement.com.