Rainbow District School Board cyberattack exposed decades of student and staff data

Rainbow District School Board, which runs schools in Sudbury, Espanola and on Manitoulin Island in northern Ontario, confirmed on February 20, 2025 that a cyberattack had exposed extensive personal information belonging to students, staff and families. The board first noticed problems on February 7 and cut internet access to all of its schools and its board office while it investigated, restoring connectivity about a week later.

The board said the compromised material included social insurance numbers and bank account details for current and former employees, social insurance numbers for former students who had received scholarships, benefits and salary information, home addresses, and medical information for current and former students. Staff employed at any point between January 2010 and February 2025 were affected, along with students and parents or guardians connected to the board from 2011 onward.

Rainbow reported the attack to the Greater Sudbury Police Service and the Ontario Provincial Police, engaged outside experts to examine what had been taken, and offered affected people two years of credit monitoring. Records released under a freedom of information request filed by Sudbury.com in March 2025 show the incident was ransomware and that a ransom demand was made. The board has declined to say how much was demanded or whether it paid, first citing exemptions under the Municipal Freedom of Information and Protection of Privacy Act and later saying the records do not exist.

The board continued reviewing the stolen data through the year. By December 2025 it had told Global News that the affected records also covered student education numbers, dates of birth and grades going back as far as 1966, plus address and voter information for Greater Sudbury residents eligible to vote in the 2022 municipal election. The board reported the incident to Ontario's Information and Privacy Commissioner and said no fraud had been confirmed.