Hamilton-Wentworth District School Board

Summary

A Canadian public school board temporarily disabled all internet access across its schools and offices after detecting signs of unauthorized access to its internal systems. Officials reported no indications of a privacy breach or data theft, but stated that the precautionary shutdown was necessary to secure the environment while investigations continued. The board followed its cybersecurity protocol by engaging its insurance provider, law enforcement, and the provincial education ministry, while maintaining communication with families through social media updates. All schools remained open during the disruption, relying on manual processes to continue educational activities, and phone lines and security systems continued to operate. The incident created challenges for some administrative functions, including remote learning, school registrations, and the verification of final marks, prompting the board to indicate that contingency plans and adjusted timelines would be communicated as needed.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 30, 2025, at 5 p.m., the Hamilton-Wentworth District School Board (HWDSB) shut down its internet after detecting signs of unauthorized access to its internal systems. The board announced the outage the same evening, and by Friday, January 31, 2025, all HWDSB-provided internet was down across schools and administrative offices. Matthew Gerard, associate director of business services for HWDSB, told CBC Hamilton on Friday afternoon that, at that point in the investigation, there were no signs of a privacy breach or data theft. He explained that the board was conducting due diligence to confirm no impacts had occurred, and that the internet had been turned off as a precaution to help secure and protect the environment. Gerard emphasized that the decision to disconnect was part of a broader cybersecurity protocol. While the outage affected internet access, phones continued to function and school security systems remained operational. Some online tools, such as email, continued to work if they were hosted outside of the board's servers.

HWDSB director of education Sheryl Robinson Petrazzini informed families of the situation in a Thursday email, stating that all schools would remain open on Friday and that manual systems had been put in place to ensure educational activities continued smoothly and safely. Friday marked the start of a new semester for some HWDSB students. Gerard and other executives visited schools and reported that operations were going well despite the disruption, noting that adjustments were minor. Earlier in the day, the board had asked people to use alternate phone numbers, but around 2:30 p.m. on Friday, HWDSB posted an update from Robinson Petrazzini stating that its regular phone lines were back up and asking the public to disregard the alternate numbers. Parents and guardians were advised to call schools or send signed notes with students to report absences. Elementary and secondary remote learning remained paused, and students were directed to use TVO Learning tools in the meantime. The board also warned that the internet shutdown could affect upcoming school registrations, with staff set to share revised plans once more information became available. HWDSB indicated that timelines for verifying final marks to send to universities and colleges by the end of the month may need to be adjusted, with a contingency plan to be communicated to families if the situation affected that process.

In response to the incident, the board followed its established cybersecurity protocol, which included reaching out to its insurance company, notifying police, and contacting the Ontario Ministry of Education. Hamilton police spokesperson Jackie Penman confirmed that the police were aware of the incident and had been in close contact with HWDSB, but stated that the board was leading its own investigative process. Gerard acknowledged that the duration of the disruption was unknown and that the board would share updates through its Facebook and Instagram accounts. He described cyberattacks on schools as a matter of "when, not if," noting that HWDSB had been preparing for such events and believed it was in a good position to defend itself. The incident followed other recent cyber-related events affecting Ontario schools, including a November cyberattack that disrupted an Ontario French-language school board and a December hack of a school management tool.

Sources

Sources available to members: 1 source.