Cyber security expert warns school board attacks could be on the rise and 'used for child exploitation'

A woman uses her computer keyboard to type while surfing the internet in North Vancouver, B.C., on December 19, 2012. THE CANADIAN PRESS/Jonathan Hayward

School boards across Canada were victims of a cyber attack this week, through a software called PowerSchool.

The popular system is used for real-time student information like grades, assignments, and attendance.

The Brant Haldimand Norfolk Catholic District School Board (BHNCDSB) announced today that they are one of the school districts impacted by a recent PowerSchool data breach, along with boards from six provinces and across the U.S.

Attacks could rise

The head of the Cyber Security program at the University of Guelph , Ali Dehghantanha, is warning cyber attacks on school boards will likely rise this year.

“When we look into the schools and the school boards, there is little to no investment in cyber security made there. That makes them very easy targets.”

He said aside from identity theft, these attacks could put children’s mental and physical health at risk too.

Student safety

According to Dehghantanha, the safety of students is at risk.

“It can be used for child exploitation attempts and it is important that we see a full scale investigation.”

Because schools collect such personal information such as date of birth, address, health card numbers and personalized learning plans, plus parent and family information, like where mom and dad work, the data collected is often more valuable to the hackers then the ransom that might be requested.

“If I want to attract trust on the children, telling them that I know your dad or your mom, and that's the name and that's the address would go a very long way on building that source within that,” Dehghantanha warned.

He would like to see awareness on this risk increased.

The Waterloo Region District School Board, which was the victim of a cyber attack in 2022, told CTV News that both students and staff are regularly educated on the dangers of child exploitation.

Stating in part, “by training staff to recognize the signs of sex trafficking, they will be better equipped to identify the cues and safely intervene if they suspect a student is being trafficked or involved in trafficking.” Adding, “The Health and Physical Education curriculum also includes learning that develops student safety skills in the online environment.”

Prioritizing cyber security 

Experts believe the next step is for schools to prioritize upgrading their cyber security.

“There are some sectors that are well below the cyber poverty line. Education is one of them,” Dehghantanha said.

He said the healthcare sector made it a priority a while ago and schools need to follow suit.

Top tier cyber security can come with a hefty price tag and school boards run on tax-payer money.

The Ontario Ministry of Education has not yet answered our request when asked what type of funding is or will be available for boards to do so.