In June 2024, the Toronto District School Board (TDSB), Canada's largest school board, suffered a ransomware attack that compromised the personal information of its students. The incident was first disclosed to the public on June 12, when the TDSB announced that an unauthorised party had accessed one of their technology testing servers. This server, utilised by the board’s IT technicians to test new software, contained sensitive student data from the 2023/2024 academic year.
What Data Was Compromised?
According to an email sent to parents on Thursday, the compromised server held a range of student information. The data accessed during the attack included students' names, school names, grades, TDSB email addresses, student numbers, and dates of birth. While this information was stored in a testing environment rather than a primary database, its exposure is nonetheless concerning, given the potential risks associated with data breaches.
Assessing the Risk
In response to the breach, TDSB officials have been working closely with their cyber security teams and external security partners to assess the situation. As of now, these teams have determined that the risk to students remains low. They have not observed any public disclosure of the compromised data, including on the dark web or other online platforms known for illicit activities. The board has also notified the Privacy Commissioner of Ontario about the potential breach as a precautionary measure.
The news of the cyberattack has sparked concerns among parents, with some feeling that the TDSB’s communication downplayed the seriousness of the incident. Anne Borden, a mother of TDSB students, expressed her dissatisfaction, noting that the board’s response did not instil confidence in their ability to safeguard student information in the future. Borden emphasised the need for the TDSB to prioritise student data security, questioning why crucial resources are allocated to other areas while cybersecurity seemingly takes a backseat.
Ransomware attacks have become an increasing concern for institutions across Toronto, including public organisations. This type of cyberattack involves malicious actors holding data or computer systems hostage until a ransom is paid. Over recent years, several prominent organisations in Toronto, such as the Toronto Public Library, SickKids Hospital, the Toronto Zoo, and the Toronto Transit Commission (TTC), have fallen victim to similar attacks.
The TDSB incident highlights the growing importance of robust cybersecurity measures within educational institutions. As schools increasingly rely on digital tools and platforms, the need to protect sensitive information becomes even more critical. Parents and the community at large are urging the TDSB to take immediate steps to enhance its security protocols and ensure that the personal data of students remains protected.
While the TDSB has stated that the risk to students is currently low, the vulnerability of school systems to cyber threats needs to be kept in check. Moving forward, it is crucial for the TDSB to rebuild trust by implementing stronger security measures and prioritising the safety of student information above all else.
