Cyberattack at Upper Canada District School Board worries students, staff and families

The UCDSB says personal information of students, staff, parents and donors were stolen in a recent cyberattack. CTV’s Dave Charbonneau reports.

A cyberattack on the Upper Canada District School Board has exposed sensitive personal information, leaving students, parents, and staff concerned about where and how the data could be used.

Students at Russell High School say the attack has disrupted their education.

“Nobody really knows what’s going on,” said student Logan Nielsen. “We have no Wi-Fi right now. All the services are down. You can’t contact teachers, can’t contact administrators. Teachers are not really in contact with anyone right now.”

The board experienced a network outage just as students were returning from Christmas holidays, confirming on Jan. 6 it had been affected by a cyber incident.

For student Khalid Oyebode, the disruption has been significant.

“It really messed up everything,” Oyebode said. “I have to do everything from home now. And stuff that we were doing online, it’s taking more time because we’ve got to do it on paper.”

Parents are also expressing concern over the breach.

“Every detail that the school has, which is everything about my kid, has been breached. They have everything,” said parent Jami Bolster.

The school board said on Wednesday that current and former staff dating back to 1999 and current and former students dating back to 2010 were affected by the breach, as were people who donated to the Champions for Kids Foundation between September 2022 and December 2024.

Technology analyst Carmi Levy said the attack reflects a growing trend.

“This is our new normal. We have seen public-facing institutions like school boards and government agencies and libraries and health care organizations being targeted increasingly over the past couple of years, particularly because the data that they hold is so valuable to a cybercriminal,” Levy said.

The school board says most of those affected by the breach have been notified, and while it believes the risk of publication and misuse of the exposed information is low, credit monitoring is being offered to certain employees and students. The breach is not connected to the PowerSchool data breach that has affected other school boards in Canada, including the Ottawa Catholic School Board.

In a statement, the board said, “The investigation into this incident is ongoing and we will continue to work with cybersecurity experts and take their advice. We are committed to minimizing the impact of this event and the risk of future attacks.”

But for some students and parents, the damage has already been done.

“Because all of our grades and everything are on there and personal emails with our teachers. And now we have no idea who has them. So that’s a little bit difficult,” said Russell High School student Kristyn Ross.

“In this day and age, that was a lot of information about kids that I’m kind of wondering how that happened,” said Bolster. “But I guess it’s too late now.”