What happened?
On Jan 8, 2025, Elk Islands Public Schools was notified by PowerSchool—a third-party software vendor whose platform we, and many other schools in North America and around the world, use to store student and staff information—of a data breach.

Although the breach did not originate on EIPS' systems, as soon as we learned of this incident, we initiated our security protocols, including engaging cybersecurity specialists. Our daily operations have not been interrupted because of this incident and schools continue to operate as usual.

We've been informed by PowerSchool that the incident is contained and there is no evidence of continued unauthorized activity in the PowerSchool platform. We are not aware of any data misuse at this point. PowerSchool has advised it has received confirmation the data accessed by the unauthorized user has been deleted and that no copies of this data were posted online.

Are accounts through PowerSchool secure?
Usernames and passwords were not impacted in this breach.

Was financial information stolen?
We want to assure you that no financial information (including credit cards) was accessed or stored in PowerSchool. When EIPS parents or guardians make a payment, they are redirected to a separate payment platform via a secure link. PowerSchool cannot access financial information stored on this payment platform, nor does this payment platform share data back with PowerSchool. The recent data breach was limited to PowerSchool’s platform only.

Who is affected?
All current and former EIPS students who attended EIPS from 2009 onwards and current and former staff who had a PowerSchool account from 2009 onwards.

What data was impacted?
On Dec. 22, 2024, an unauthorized party accessed PowerSchool’s platform where we store student and staff information. EIPS has completed a thorough review of impacted data and can confirm the following data was accessed as a result of this incident:

• Students: name, date of birth, grade level, mailing address, Alberta Student Number, parent/guardian names, home phone number, graduation year and some emergency contact and medical information (for example, doctors' names and phone numbers)

• Staff: name, work email address, employee ID, PowerSchool username (firstname.lastname)

Note: Data taken for former students and staff would have been accurate as of the last time they were enrolled or employed with the Division, respectively.

Documents (for example, birth certificates) uploaded within PowerSchool were not impacted as a result of this incident.

Were photos accessed?
No staff or student photos were accessed in this incident.

What happens next?
We will be contacting guardians of currently enrolled students and current staff directly with a letter to share information about the incident and any recommendations on steps you can take to protect your and your child’s information. Students not currently enrolled and staff no longer employed who are impacted by this data breach are contacted through this website notice. If there are any important updates, we will release it through our website.

In the meantime, questions can be submitted via the Division website online contact form or directly with your school administration.