Cyberattacks can take entire school networks out. It’s time to pay more attention to them, experts say
A surge of school-related emails floods parents’ inboxes on a regular basis — from reminders about pizza lunch fundraisers to updates about upcoming school trips. However, one notification that no parent wants to receive is news of a cyberattack. Unfortunately, this has become a common occurrence in schools across Canada.
Recently, students in an Ontario school board returned from their winter break to find themselves in classrooms without internet access and disrupted communication systems due to a cyber incident. Similarly, multiple school divisions across the country, including the largest one in Canada, informed families about a significant data breach connected to PowerSchool, an external provider that manages functions such as students’ personal information and communication with parents.
“It’s essentially a one-stop shop for anything related to that student,” explained Ron Eberts, associate superintendent of technology and information services at Red Deer Public Schools, one of the affected Alberta school divisions. “This is not just an issue in Newfoundland and Labrador. It is a widespread problem that has affected numerous schools throughout North America.”
Cyberattacks pose a serious threat to schools, disrupting day-to-day operations by disabling integrated, board-wide networks and jeopardizing the vast amount of information collected from students, families, and staff. Experts emphasize the need for increased attention and action to strengthen school boards’ defenses against cyber threats.
According to Ontario’s privacy commissioner, Patricia Kosseim, cyberattacks are on the rise in terms of scope, frequency, and sophistication. Schools, like other public institutions, are appealing targets for cybercriminals due to the vast amount of personal information they hold and the essential services they provide. Schools do not have the option of shutting down operations temporarily, making them vulnerable to ransom demands from cyber attackers.
An attack on Manitoba’s Pembina Trails School Division in early December highlighted the extent to which schools rely on internet-connected networks and applications for daily operations. The incident caused disruptions to computer systems, P.A. systems, attendance tracking, and internet access, affecting every aspect of school functioning.
Ivo Wiens, a cybersecurity expert, emphasized that cyber attackers are primarily motivated by financial gain, often resorting to ransom demands to restore systems or using stolen data for fraudulent activities. The compromised student information, such as names, addresses, and phone numbers, can be used to commit identity theft and fraud, underscoring the importance of safeguarding school data.
Official tracking of cyber incidents in Canadian schools is limited, with only a few jurisdictions requiring public K-12 schools to report cyber incidents resulting in privacy breaches. Mandatory reporting would enable provincial privacy regulators to better support institutions affected by cyberattacks.
To mitigate the risks of cyber threats, schools must invest in IT and cybersecurity measures, develop incident response plans, limit the collection of student data to essential information, and collaborate with other boards to share resources and best practices. Updated privacy legislation is also needed to address gaps in protecting students’ school data.
In the face of increasing cyber threats, transparency and clear communication with parents are crucial. Parents like Jack Ammendolia emphasize the importance of schools being honest and transparent about cyber incidents, allowing parents to take proactive measures to protect their children’s information. By implementing robust cybersecurity measures, enhancing communication with parents, and staying vigilant against cyber threats, schools can better safeguard student data and maintain the integrity of their operations.
