Cyber Incident Victim: School District No. 5 Southeast Kootenay
Date:
Jan 2019
Location:
Canada
Summary
School District No. 5 Southeast Kootenay experienced a cyber incident involving the Emotet virus, which infected computers at its School Board Office and Fernie Learning Centre. The district assessed that the malware aimed to propagate through email attachments rather than to exploit personal information potentially contained within emails. Following the discovery, officials notified the Office of the Information and Privacy Commissioner, adhered to prescribed protocols, and issued a public disclosure about the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 23, 2019, School District No. 5 (SD5) Southeast Kootenay in Canada experienced a cybersecurity incident involving the Emotet virus. The malware infected computers at two locations: the School Board Office and the Fernie Learning Centre. The district discovered the infection through internal monitoring but did not specify the exact detection method. Emotet, a known malware strain often spread through malicious email attachments, compromised the affected systems. The attack disrupted normal operations at these facilities, though the district did not disclose the duration or full extent of technical disruptions. SD5 initiated containment protocols immediately upon identifying the infection to prevent further spread across their network.
SD5 leadership, including Secretary-Treasurer Alan Rice, assessed that the attackers' primary intent was propagating Emotet through email systems rather than stealing or exploiting personal information. The district formally notified British Columbia’s Office of the Information and Privacy Commissioner (OIPC) shortly after discovering the breach, complying with provincial reporting requirements. As part of their response, SD5 followed all remediation protocols provided by the OIPC, including technical containment measures and public disclosure obligations. The district issued a public notification to inform stakeholders about the email security breach, emphasizing transparency while maintaining that personal data misuse was unlikely based on their forensic assessment. No evidence suggested unauthorized access to student or employee records beyond potential exposure within compromised email communications.