Upper Canada District School Board reports cyberattack, data breach

The Upper Canada District School Board (UCDSB) is reporting a significant cyber attack and subsequent data breach.

The attack, which began on January 5, 2025, resulted in a complete shutdown of all internet services at the board, including student email, online schooling access, and in-school wireless internet. While initially reporting no data compromise, the board confirmed in a January 22 update that an extensive data breach had occurred.

Internet services remain offline. The board has confirmed this incident is unrelated to the december PowerSchool data hack affecting schools across six provinces and several US states. The incident has been reported to the Brockville Police Service and the Information and Privacy Commissioner of Ontario

The scope of affected individuals spans multiple decades and includes:

• Current and former students (2010-present)
• Current and former employees (1999-present)
• Former students who received bursaries (2001-present)
• Donors to schools and the Champions 4 Kids foundation

The compromised data includes:

For Employees:

• Social Insurance Numbers
• Bank deposit information
• Work history
• Personal identification information

For Students:

• Names
• Addresses
• Contact information
• Academic marks
• Medical reports and diagnoses
• Accommodation reports
• Behavioral reports
• Incident reports

The nature of the attack and the number of affected individuals is not disclosed.

Update - Canadian media, using Ministry of Education enrolment data, estimate approximately 52,000 students (past and present) are impacted. WIth parent and guardian information, that number increases to about 160,000 people. The board has an average of over 4,000 employees employed each year. Attrition and retirement rates for the board are not known so an educated estimate is about 164,000

The board is offering affected individuals two years of credit monitoring services through TransUnion.