Personal info, including banking details, exposed in UCDSB data breach

An unidentified person types on a keyboard in a darkened room. (Pexels)

The Upper Canada District School Board (UCDSB) says it has learned that personal information of current and former employees, students, family members and some donors to its charitable foundation was stolen in a recent cyber attack.

The UCDSB reported a network outage related to a cyber incident on Jan. 6. In an update Wednesday, it said it learned that personal information had been stolen in the attack.

“Those affected by the incident include current and former staff members, students and their parents or guardians, and donors or other payors to the Board office or Champions for Kids Foundation,” the UCDSB said.

“We have notified the majority of those affected and will continue to analyze the stolen data to determine if further notification is necessary. This process may take time to complete. We understand this news may be concerning for people, and we are deeply sorry for this.”

The school board said it believes the risk of publication and misuse of the exposed information is low; however, the UCDSB is providing credit monitoring for eligible groups, which includes past employees among others.

The incident has been reported to the Brockville Police Service and the Information and Privacy Commissioner of Ontario. The UCDSB said it is committed to strengthening its cybersecurity program to prevent future incidents.

The UCDSB says there is no indication this incident is related to the PowerSchool breach that affected other school boards in six provinces, including the Ottawa Catholic School Board.

Who was affected and what information was likely exposed?

Current and former employees dating back to 1999:

Social insurance number, bank account number, date of birth, gender, personal contact information (which may no longer be current), Employee ID, compensation and benefit information, employment history information, Ontario Ministry Educator Number (for teachers only), and background check information. Other stolen information about members of this group includes information about investigations, grievances, and other workplace matters.

“If you are in this group, the UCDSB will provide you with a two-year TransUnion credit monitoring service, free of charge. This service will you help monitor for signs of identity fraud, so that you can react swiftly to protect yourself in the event of an identity theft attempt,” the board said.

Current and former students dating back to 2010:

Date of birth, gender information, home address information, academic achievement data (grades and completion data), Ontario Education Number (OEN), and parent/guardian identity information, including immigration information, emotional well-being information, and medication information.

Current and former students with an identified exceptionality who have been enrolled in a UCDSB school at any time since 2010:

Status as being identified with an exceptionality, assessment background information, medical diagnosis and information about related needs, accommodation and student support information, and behavioural and incident information, in addition to the data elements impacted for all students.

Parents and guardians of affected students:

Contact information (including phone numbers and email addresses), and place of employment.

Former UCDSB students who were enrolled in a UCDSB school since 2001 and received a bursary:

Social insurance number, and home address information.

“The Board is providing affected bursary students who have reached the age of majority with a complimentary two-year TransUnion credit monitoring service,” the UCDSB said.

Donors and other payors to the UCDSB board office or the Champions for Kids Foundation between Sept. 1, 2022 and Dec. 13, 2024:

Bank account information.

“Electronic funds transfers and school-directed cheques were not impacted,” said the board.

If you are affected, you can find links to the forms required to fill out to apply for credit monitoring at the UCDSB’s website.

The Upper Canada District School Board includes schools in the counties of Lanark, Leeds, Grenville, Stormont, Dundas, Glengarry, Prescott and Russell. There are 77 elementary and secondary schools in the board.