June TDSB cyberattack included student names, contact info

Published Aug 30, 2024  •  2 minute read

A Toronto District School Board logo is seen on a sign in front of a high school in Toronto, Tuesday, Jan. 30, 2018. Photo by Frank Gunn /THE CANADIAN PRESS

Data accessed during June’s ransomware attack on Canada’s largest school board included personal information of students.

Article content

In an email to parents sent on Thursday, the cyberattack announced by the Toronto District School Board (TDSB) on June 12, involved unauthorized access to a board-owned technology testing server — used by board IT technicians as a testing environment for new software.

“We have now confirmed that the testing environment contained 2023/2024 student information that could include name, school name, grade, TDSB email address, TDSB student number and day/month of birth,” read the email. 

“We want to emphasize that, at this time, our cyber security teams and external security partners have advised that the risk to our students in connection with this cyber incident is low and that they have not seen any public disclosure of student data as part of their investigations, which includes monitoring of the dark web and other online locations.”

Article content

The school board says they’ve proactively informed the Privacy Commissioner of Ontario of the potential breach.

Ransomware is a cyberattack that involves malicious parties holding information or computer servers hostage unless a ransom is paid.

Toronto Public Library, Sick Kids Hospital, the Toronto Zoo, and the TTC all experienced prominent ransomware attacks over the past few years.

Recommended from Editorial

1. 

   Ransomware group apologizes saying 'partner' was behind SickKids attack

2. 

   TTC target of ransomware threat

Anne Borden, the mother of TDSB students, told the Toronto Sun she was taken aback by the news, and felt the tone of the board’s email downplayed the seriousness of the breach.

“That made me feel really not good about TDSB in terms of trust,” she said.

“If this is no big deal to them, what confidence do I have that they will really make things secure again?”

She said the TDSB needs to realign its priorities so that the information security of its students is paramount.

“They will spend hundreds of thousands on no-bid staff development workshops, many of which objectively don’t improve the school environment, but they can’t get a team together to stop data breaches of personal data of children?” she said.

“Our kids need better from them.”

[email protected]
X: @bryanpassifiume

Article content