Dear families, 

As you are aware, on November 8, York Region District School Board experienced a cyber incident resulting in a network outage. We have been working diligently in-house and with third party experts to analyze the data that was compromised and identify those affected. 

We are now finalizing this data analysis and those affected will receive direct notification starting June 7, 2024. All notifications will be complete by June 28. If you or your child’s personal data was included in a data breach as part of the cyber incident, you will be notified directly within these dates with more specific information related to data that may have been compromised. We will use our existing contact information to provide individual notifications. No family/student financial information was accessed. 

We continue to work closely with technical experts and to take steps to reduce the potential risk of similar incidents in the future. 

Thank you for your patience, support and understanding.

Frequently Asked Questions

1. What happened? 

   • As previously communicated, on November 8, the Board experienced a cyber incident that affected IT products and services. Those services have been restored and the Board continues normal operations.

2. What steps are being taken to address the situation? 

   • The Board’s IT team, in partnership with cybersecurity experts, contained the incident, re-secured the Board’s network and implemented enhanced security measures. The Board has also analyzed data and is notifying affected individuals. We are taking this matter very seriously.

3. Why has the Board waited until now to confirm whose data was compromised? 

   • Since the Board confirmed that some of its data was compromised in December 2023 it has been conducting a comprehensive analysis to ensure accurate notification to all those directly affected.

4. How long will it take before I am notified if my child’s personal information has been compromised?

   • Notifications are being distributed between June 7-28, 2024. If you have not received a message from the school board by June 28, your data was not affected.

5. How will I be informed if my child’s data or my data as a parent/guardian has been compromised? 

   • Notifications are being distributed between June 7-28, 2024. If you have not received a message from the school board by June 28, your data was not affected.

6. How do you know the compromised information won’t be sold or released?

   • The risk is low and we have no evidence of any misuse of information at this time. 

7. How was the breach contained and mitigated?

   • Upon discovery of the breach, we immediately isolated the affected systems and removed the unauthorized access. We continue to enhance and strengthen our security posture through advanced security practices. 

8. What steps have been taken to prevent future breaches?

   • We continue to enhance our security infrastructure, update our security protocols, and are conducting regular audits to ensure the integrity of our systems.

9. Was my information affected in the breach?

   • If you are a former employee who is at risk we will notify you by June 28. 

10. Can we expect any similar breaches in the future?

    • While no system can be completely secure, we continue to take extensive measures to protect against future breaches. We are committed to continuously improving our security to safeguard your information.

11. If affected by the breach, what data has been compromised?

    • All those directly affected by the breach will be contacted individually. Direct notifications for those affected will include the type of data that may have been compromised. 

12. How will you communicate updates about the breach?

    • We will be contacting individuals who are at risk directly.

13. Did the Board notify the Information and Privacy Commissioner/Ontario?

    • Yes. We first notified the IPC of the incident on November 10 and are cooperating with its inquiries.