Rocky View Schools (RVS) has issued a new update confirming a reported extortion attempt involving data previously accessed during a December 2024 cybersecurity breach.
In a written statement posted on May 7, 2025, RVS confirmed:
"PowerSchool informed their customers, including Rocky View Schools, that a threat actor has reached out to some PowerSchool Student Information System customers in an attempt to extort them using data from the previously reported December 2024 incident."
RVS stated that PowerSchool confirmed that the systems remain secure and that no new data was accessed. As a result, PowerSchool has extended the deadline to enroll in identity protection and credit monitoring services to July 31, 2025. Enrollment instructions for these services are available on the RVS website.
How to Access Support Services
PowerSchool is continuing to offer Experian identity protection services to all affected students and staff, as well as TransUnion credit monitoring for those who have reached the age of majority.
This extension follows earlier updates issued by RVS beginning in January, when PowerSchool first disclosed the breach to the division on January 7, 2025. RVS reported that the breach occurred on December 28, 2024.
Previous Updates and Impacted Data
In its January 9 update, RVS confirmed that an unauthorized party gained access to certain PowerSchool student information system demographic data through compromised credentials. RVS said that financial information was not stored in PowerSchool and that the system remained operational.
On February 10, 2025, RVS provided further clarification, noting that the breach involved records of current and former students and staff dating back to 2012. It confirmed that the accessed data included:
"Student ID numbers, encrypted passwords, first and last names, dates of birth, gender and home addresses. Some records also included parent or guardian names, emergency contacts, and doctor contact details."
The February 10 notice also stated:
"Additional data provided by parents to support student learning may have been accessed, including medical history, custody and court orders, and coding or programming data. For staff, the exposed data included names, position titles, contact information, school codes, RVS email addresses, login IDs and encrypted passwords that were at least three years old and no longer used to access PowerSchool."
RVS confirmed that no personal documents or photos were involved, stating that Social Insurance Numbers and other sensitive financial data were not part of the breach.
However, in a separate breach notice, PowerSchool stated:
"The information exfiltrated for any given individual varied across our customer base," and could have included "Social Insurance Number" as part of the data accessed.
RVS has not updated or revised its February 10 statement regarding Social Insurance Numbers.
Third-Party Investigation
On March 12, 2025, RVS posted an update linking to a third-party cybersecurity investigation report prepared by CrowdStrike, a firm hired by PowerSchool.
System Status and Next Steps
Despite the extortion attempt, RVS has repeatedly stated that PowerSchool’s system remains functional and secure:
"The system remains fully functional and is safe to use."
Sign up to get the latest local news headlines delivered directly to your inbox every afternoon.
Send your news tips, story ideas, pictures, and videos to news@discoverairdrie.com. You can also message and follow us on Twitter: @AIR1061FM.
DiscoverAirdrie encourages you to get your news directly from your trusted source by bookmarking this page and downloading the DiscoverAirdrie app.