Largest School Board in Canada, TDSB, Hit by Ransomware Attack

The Toronto District School Board (TDSB) recently announced a cyber incident involving a ransomware attack that compromised its technology testing environment.

The breach was discovered by TDSB‘s IT Services team, who promptly initiated their response plan to secure data and protect critical systems. The main TDSB systems remain operational and unaffected by the incident.

The TDSB, the largest school board in Canada, serves over 240,000 students across 583 schools, with a substantial number of staff encompassing 40,000 individuals. This vast network of students and staff underscores the potential scale of the impact, raising significant concerns about the security and privacy of personal information.

Upon detecting the unauthorized access, TDSB's cybersecurity team took immediate measures to contain the breach and safeguard essential data. The Toronto Police Service has been informed, and third-party cybersecurity experts have been engaged to thoroughly investigate the incident. These efforts aim to understand the breach's nature, its impact on the network, and any potential exposure of personal information.

As a precaution, the TDSB has notified the Information and Privacy Commissioner of Ontario. Should the investigation reveal that personal information has been compromised, the board will notify all affected individuals accordingly. Unfortunately, the scenario of young students having had their personal information exposed hasn't been ruled out yet.

The ongoing investigation restricts the amount of detailed information that can be shared at this time, but the TDSB assures the community of their commitment to transparency and thoroughness in addressing the incident.

For now, the TDSB encourages those with questions to reach out via the provided contact email, cyberincident@tdsb.on.ca, and promises to keep the community updated as new information becomes available.

As of yet, no ransomware groups have listed TDSB on their extortion portals, hence the perpetrators are currently unknown. Presumably, the ransomware attack is still at the early negotiation phase of the extortion.