Ransomware attack on Toronto District School Board compromised students' personal information

The Toronto District School Board, the largest school board in Canada, said the confidential information of its students were compromised during a ransomware attack that struck its systems in June.

In a letter addressed to parents and caregivers, the District School Board said that it recently became aware of an unauthorised third-party access to its technology testing environment. The technology testing environment is used by the board’s IT team to test programs before they are run live on TDSB systems.

Immediately after identifying the unauthorised access, the school board took steps to secure the affected systems and launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.

The school board said it notified the Toronto Police Service and the Information and Privacy Commissioner of Ontario about the data security incident. TDSB added that its own systems are operating as usual and haven’t been impacted by the ransomware attack.

In an update shared on August 29, TDSB said that its investigation has revealed that the affected test environment contained sensitive personal information of students who enrolled for the 2023/2024 session. The compromised data included students’ names, school names, grades, TDSB email addresses, TDSB student numbers and day/month of birth.

As of now, the school board found no evidence of the compromised information being misused and school board staff are taking immediate steps to further strengthen its internal network. Work to recover the affected systems is still ongoing and the school board is still in the process of determining the scope of the incident.

On August 29, the LockBit ransomware group claimed responsibility for the cyber attack on TDSB and listed it as a victim on its data leak site. While the group did not share details of the stolen data, it has given 13 days for the school board to meet its ransom demands, failing which the group has threatened to publish the data in its possession.