Cyber Incident Victim: Edsembli
Date:
Feb 2021
Location:
Canada
Summary
A ransomware attack targeted Edsembli, a vendor providing school information systems managing student enrollment, grades, and attendance for Nunavut's Department of Education and other regions. The incident caused system lockouts, disrupting operations and delaying transcript and grade generation, though no data loss was confirmed. Full system functionality remained partially restored following the disruption period.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 26, 2021, a ransomware attack disrupted Edsembli, the vendor responsible for managing Nunavut’s school information system. The system stored critical student data including grades, attendance records, and enrollment details. Department of Education staff were immediately locked out of the platform, preventing routine administrative operations. The incident persisted until March 9, 2021, marking a 12-day period of inaccessibility. While no data loss occurred, the attack caused significant processing delays, particularly affecting the generation of student transcripts and final grades. The disruption impacted educational operations across Nunavut, though the exact number of affected schools or students was not specified in available reports. Manitoba school districts also experienced related disruptions earlier in March, suggesting broader regional implications from the Edsembli compromise.
The Department of Education publicly confirmed the ransomware incident but did not disclose the attackers’ identity, ransom demands, or initial intrusion methods. Restoration efforts were ongoing at the time of reporting, with full system functionality not yet reinstated. Operational impacts included prolonged administrative bottlenecks, though teaching activities reportedly continued without direct interruption. No evidence suggested unauthorized access to or exfiltration of student data. The incident underscored dependencies on third-party vendors for critical educational infrastructure and highlighted vulnerabilities in centralized systems serving geographically dispersed regions. Recovery timelines remained unspecified beyond the March 9 partial access restoration.