Dear Parents/Guardians/Caregivers,
Further to the information we shared on June 12, 2024, we wanted to provide an update on the cyber incident (ransomware) experienced by the Toronto District School Board (TDSB). At that time, TDSB became aware that an unauthorized third party gained access to TDSB’s technology testing environment, which is a separate environment used by TDSB IT Services to test programs before they are run live on TDSB systems.
We have now confirmed that the testing environment contained 2023/2024 student information that could include name, school name, grade, TDSB email address, TDSB student number and day/month of birth.
We want to emphasize that, at this time, our cyber security teams and external security partners have advised that the risk to our students in connection with this cyber incident is low and that they have not seen any public disclosure of student data as part of their investigations, which includes monitoring of the dark web and other online locations.
We are entrusted with important information and we take that responsibility very seriously. That is why staff, working around the clock, took immediate steps to further protect information following this incident coming to light including:
- Immediately engaged with cyber security experts to isolate and secure the affected systems and determine the scope of the breach;
- Immediately disconnected the test environment;
- Further strengthened our systems to deter future incidents; and
- Engaged with law enforcement, who investigated the matter.
In the interest of transparency and as recommended by the Office of the Information and Privacy Commissioner of Ontario, we are making this announcement to notify all current TDSB students.
While you are entitled to file a complaint with the Information and Privacy Commissioner of Ontario (the “IPC”), we have already notified them of this incident and are following the recommendations they have made. We have also notified our government partners. The privacy complaint form can be found on the IPC website at https://www.ipc.on.ca/en/resources/forms/file-privacy-complaint-under-ontarios-provincial-and-municipal-privacy-laws
Should you have any questions, please contact cyberincident@tdsb.on.ca and we will do our best to answer as much as we can.
Thank you.