BROCKVILLE – A cyberattack in early January has resulted in an extensive data breach at the region’s largest school board.
Administration at the Upper Canada District School Board announced in an update on the ongoing internet issues at the board that an extensive data breach has been discovered. Students who enrolled or attended a UCDSB school from 2010 to present, employees and former employees since 1999 to present, and any former student who received a bursary through a UCDSB school anytime from 2001 to present has had their personal data compromised. Donors to schools, and to the board’s Champions 4 Kids foundation may also be affected.
“The Board’s investigation has revealed that the perpetrators of this cyber attack stole personal information concerning members of the UCDSB community. We understand this news may be concerning for people, and we are deeply sorry,” the board said in its January 22 update.
On January 5, a cyberattack resulted in the shutdown of all internet services at the board. Until now, the board had said there had not been any data compromised based on their investigation.
Internet services remain offline including student email, access to online schooling through the schools, and in-school wireless internet.
Thousands affected
The data breach affects thousands of current and former students, and thousands of current and former employees.
The UCDSB reported the incident to the Brockville Police Service and the Information and Privacy Commissioner of Ontario.
“Based on the investigation by our cyber experts and our ongoing restoration process, we believe the risk of publication and misuse of the stolen data is low,” board officials said replying to further questions from The Leader.
The magnitude of the data breach is extensive. Employee data compromised likely includes social insurance numbers, deposit information, work history, and other personal identification information.
For students enrolled at UCDSB schools any time since 2010 until now have personal identification information like name, address, contact information, and marks compromised. Also compromised is information relating to the status of special education students or students with identified “exceptionalities.” These include medical reports and diagnosis, accommodation reports, behavioural reports, and incident reports.
For all employees and students impacted, the board is offering two year credit monitoring services through TransUnion.
Board officials did not provide an estimate on the number of people affected by the data breach.
“We are not able to provide an estimate at this time,” the board said.
Using Ministry of Education enrolment data, The Leader estimates approximately 52,000 students (past and present) are impacted by the breach. Adding in parent and guardian information, that grows to approximately 160,000 people. The board has an average of over 4,000 employees employed each year. Attrition and retirement rates for the board are not known.
No connection to PowerSchool breach
The board has said that its cyberattack is not related to the US-based PowerSchool data hack from December that has impacted schools across six provinces and several US states.
The school board’s investigation is ongoing. “Know that we are also committed to strengthening our cybersecurity program to better protect against future incidents,” the board said in its update.
For those who are potentially affected by the UCDSB data breach, visit the school board’s website www.ucdsb.on.ca for links to the credit monitoring services.
When asked about how the board will safeguard information in the future, the board said it is committed to strengthening its cybersecurity program: “We will make changes to our program based on the results of our investigation, which is not yet complete.”
In a January 27 update to UCDSB families, the board provided details on service restoration progress. Staff have regained access to their email and student access is being worked on. School wifi access has been restored, but can only be accessed for internal sites – there is no access from school wifi to outside websites like YouTube or Google.
Secondary students have been unable to access any e-Learning courses since the Christmas Break. Those classes will be graded based on the work completed before Christmas.
There are no exams for those online classes. Report cards will be available starting Feb. 20, a week later than planned.
Feature image by iStock.com/Techa Tungateja
