TDSB Admits Breached “Test Environment” Hosted Actual Student Data

The Toronto District School Board (TDSB) has officially confirmed that a data breach occurred following a ransomware attack in June 2024, which compromised a technology testing environment containing student information.

This acknowledgment comes as the notorious LockBit ransomware group claimed responsibility for the attack by listing TDSB on its extortion site and threatening to release stolen data if a ransom is not paid by September 12, 2024.

The Toronto District School Board is the largest in Canada, serving over 240,000 students across 583 schools, supported by a staff of approximately 40,000.

Incident details

The breach, initially reported by the TDSB on June 12, 2024, involved unauthorized access to a non-production environment used by the IT Services team allegedly for testing purposes. It is now revealed that the environment, which was believed to be isolated from core systems, contained sensitive information for the 2023/2024 academic year, including:

• student names,
• school names,
• grades,
• TDSB email addresses,
• student numbers,
• and dates of birth.

Upon discovery of the breach, TDSB says it acted swiftly to mitigate the damage, engaging cybersecurity experts to isolate and secure the affected systems. The test environment was promptly disconnected. In addition to these measures, the TDSB collaborated with law enforcement and notified the Information and Privacy Commissioner of Ontario (IPC) as part of its compliance and transparency efforts.

The TDSB now reassures the public that, based on current assessments by cybersecurity teams and external partners, the risk to students remains low. There has been no confirmed public disclosure of the compromised data, and continuous monitoring of the dark web has not revealed any evidence of student information being traded or leaked.

LockBit threat looms

Though TDSB’s claims are no data having been leaked are true, for now, the notorious ransomware gang LockBit threatens to change this. The group has posted a notice on its dark web site, setting a deadline of September 12, 2024, for the payment of an undisclosed ransom. Failure to meet this demand, according to LockBit, will result in the public release of the stolen data.

The TDSB has not publicly commented on whether it intends to negotiate with the attackers, adhering to the typical stance of not engaging with cybercriminals.

In light of the current situation, TDSB students are recommended to monitor their accounts closely for any suspicious activity, watch out for scamming and phishing attempts, and remain vigilant for unsolicited communications. Parents, guardians, and students are also reminded that they can file a complaint with the Information and Privacy Commissioner of Ontario if they have concerns about how their data has been handled.