One of the biggest public school boards in Southern Ontario has publicly acknowledged a cyber attack, over a month after it was detected.
The York Region District School Board, which covers an area stretching from Toronto in the south to Lake Simcoe in the north, with a student population of over 128,000, said in a statement this week that late on Nov. 8, the IT department became aware of a cyber incident.
The cyber security response team immediately took mitigating action to preserve and contain data and ensure critical systems were protected, the statement says.
Since then, board has been working with third-party experts, including legal and technical, to analyze the extent of the incident and restore services. Law enforcement has also been contacted.
As part of its due diligence, the board will conduct a full investigation into what occurred, the statement says, although there is no promise the results will be made public.
“We know the public rely and trust the Board to maintain its data secure,” the statement says. “All our actions have been taken to ensure the integrity of staff and student data and ensure privacy is protected.”
Public sector organizations like school boards are favoured targets of hackers, who believe they can be more easily pressured into paying to get access back to stolen or encrypted data.
Related content: Durham region school board hit by cyber attack
In January, the Huron-Superior Catholic District School Board said unnamed attackers who stole “a significant number of files from a board file server” had deleted the data. Ultimately current and former students were sent data breach notification letters.
However, vindictive hackers who don’t get paid may release data on children. In April, NBC News reported that a ransomware gang that broke into the Minneapolis Public Schools earlier this year published an enormous cache of files that appear to include highly sensitive documents on schoolchildren and teachers, including allegations of teacher abuse and students’ psychological reports.
