Toronto District School Board says student data stolen in June ransomware attack

The Toronto District School Board, the largest school board in Canada with roughly 235,000 students across 582 schools, confirmed on 29 August 2024 that student information had been stolen in a ransomware attack it first reported in June.

The board said an unauthorised third party had gained access to its technology testing environment, which it had initially believed did not hold live student records. It later determined that data from the 2023/2024 school year was involved, covering student names, school names, grades, board email addresses, student numbers and dates of birth. Comparitech reported that no social insurance numbers or financial information were accessed.

The LockBit ransomware operation claimed the attack in late August and gave the board until 12 September 2024 to pay an undisclosed ransom. TDSB did not verify LockBit's claim. Researchers cautioned that LockBit had been posting inaccurate or recycled victim listings since law enforcement disrupted its infrastructure in February 2024.

The board said it isolated and disconnected the affected test environment, strengthened security controls, engaged external experts and notified law enforcement and the Office of the Information and Privacy Commissioner of Ontario. It told parents the risk to students was low and that monitoring had found no sign of student data on the open or dark web. The board did not disclose how many students were notified and did not offer credit monitoring or identity theft protection.