Kitchener-Waterloo

Waterloo public board confirms student database also accessed in cyberattack

The Waterloo Region District School Board says an investigation into a cyberattack in July has found that the personal information of current and past employees, and some student information was accessed.

The school board says it's taking additional measures to strengthen systems

Waterloo Region District School Board sign outside their main office.
A Waterloo Region District School Board spokesperson said the board has recovered all the compromised data and received assurance that any data taken as part of the cyberattack has been deleted. (Waterloo Region District School Board/Twitter)

The Waterloo Region District School Board (WRDSB) says an investigation into a cyberattack in July has found that databases containing the personal information of some students was accessed along with current and past employees.

In July, the school board said it was notified of unauthorized access to its IT system. The Ontario Provincial Police launched an investigation, alongside the school board's own internal team, and the school board released the findings late Friday afternoon.

"We recently had an investigation finalized and that investigation let us know for certain that databases containing personnel information as well as one small student database was accessed," Eusis Dougan-McKenzie, the school board's chief communications officer told CBC Kitchener-Waterloo.

Dougan-McKenzie said it was still trying to figure out exactly what student information was compromised.

Staffing data dating back to 1970

"This cyber intrusion disrupted our operations, and WRDSB responded immediately by engaging cyber security experts and prioritizing a full return of our operational functions," wrote Dougan-McKenzie in a blog post published Friday.

However, when asked about how many employees were impacted by the breach, Dougan-McKenzie said that information was not readily available due to lingering effects of the cyber attack. 

The school board said cyber attackers illegally accessed a restricted drive that contained sensitive, personal information of all current and past employees dating back to 1970. These files were related to payroll and benefits and included names, birthdates, banking information and social insurance numbers. 

The payment history for employees dating back to 2012 was also accessed.

The school board said certain student information was accessed, though the full scope of that is unclear. It said it's continuing to investigate and will provide more information once it's available.

The school board said it will contact impacted people if more information is discovered at a later date.

It said that it has recovered all the data and received assurance that any data taken as part of the cyberattack has been deleted.

Next steps

As a result of the cyber attack, some employees were told to expect late payments.

"It has been difficult, especially for staff both those waiting on payments and records of employment and those who were working on resolving this issue," Dougan-McKenzie added.

The school board said it's taking additional measures to strengthen its systems.

It said it's going to invest in leading technologies to protect systems and data from cyber attacks, with the help of its internal IT team and external IT experts.

The school board the Privacy Commissioner Of Ontario has been notified of the incident and people can file a complaint online.

"[The school board] wishes to emphasize that we are treating this matter with the utmost concern and apologize for any inconvenience this incident may have caused," the school board's statement said.

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversation  Create account

Already have an account?

now