Mass cybersecurity breach of learning platform hits Canadian post-secondary schools

• Share on Facebook
• Share on Bluesky
• Share on X
• Copy Link

In Ontario, schools including the University of Toronto, Mohawk College, OCAD University and Western University’s Ivey Business School were among the 9,000 schools impacted by the incident worldwide.

'BEAUTIFUL, EMOTIONAL, EXPLOSIVE'

Powwow documentary brings cinematic Indigenous storytelling to the Battlefords

15m ago

COST OF LIVING

'It's a difficult time for us': Battlefords food bank cuts hampers as Saskatchewan grocery inflation tops Canada

17m ago

Here Fishy Fishy

Fishing season opens in Southern Management Zone as snowmelt delays Northern, Central areas

3h ago

British Columbia schools including UBC and Simon Fraser University also reported being impacted by the incident, as well as the University of Alberta.

A spokesperson for Canada’s federal privacy commissioner said the office is aware of the matter and has reached out to the company to “obtain more information and determine next steps.”

Ontario’s privacy commissioner’s office said it was notified of the incident Friday and is looking into the matter.

“Given the potential seriousness of this cyber incident, our office is closely monitoring the situation,” it said in an emailed statement.

Though private sector companies such as Instructure are subject to federal privacy laws, Ontario’s provincial and municipal institutions are still accountable for protecting records and personal information in their custody “regardless of who processes data on their behalf,” the statement said.

The Instructure breach follows the October sentencing of a Massachusetts man who pleaded guilty to the cyber extortion of two companies, including education software firm PowerSchool, in a 2024 cyberattack affecting current and former students, parents and staff at some school boards in the U.S. and Canada.

PowerSchool later said it paid a ransom to the threat actor and provided credit monitoring and identity protection services to those impacted.

Privacy watchdogs in Ontario and Alberta investigated the PowerSchool breach, concluding in a report last November that more than five million Canadians were affected by the cyberattack and school boards lacked adequate response plans, among other issues.

The provincial privacy commissioners made recommendations in their reports, including that the boards review their agreements with PowerSchool, implement monitoring systems and ensure adequate breach policies are in place.

This report by The Canadian Press was first published May 8, 2026.

Rianna Lim, The Canadian Press