Cyber Incident Victim: Hamilton-Wentworth District School Board
Date:
Jan 2025
Location:
Canada
Summary
The Hamilton-Wentworth District School Board disabled internet access across its systems after detecting unauthorized access to internal networks, though no evidence of data theft or privacy breaches was initially found. Schools remained operational using manual processes, while remote learning and some online services were disrupted. The board engaged law enforcement, its insurer, and education authorities, maintaining phone and security functionality. Potential delays were anticipated for student registrations and academic transcript submissions to post-secondary institutions, with contingency plans pending resolution. Officials emphasized preparedness for such incidents, acknowledging cyber threats as an ongoing sector risk.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 31, 2025, the Hamilton-Wentworth District School Board (HWDSB) confirmed it was investigating a cyber incident involving unauthorized access to its internal systems. The board proactively shut down all HWDSB-provided internet access at 5 p.m. on January 30 as a precautionary containment measure, disabling internet connectivity across schools and administrative offices. Associate Director Matthew Gerard stated no evidence of data theft or privacy breaches had been found during initial assessments, though investigations remained ongoing. Schools operated normally on January 31 using manual processes for educational activities and attendance tracking, with functional landline phones and on-premises security systems unaffected. Some externally hosted services, including certain email systems, remained accessible. HWDSB activated its cybersecurity protocol, notifying Hamilton Police, the Ontario Ministry of Education, and its insurance provider. Police confirmed coordination with the board but deferred lead investigative authority to HWDSB.
The internet outage disrupted multiple operations, including elementary/secondary remote learning programs, which were replaced with TVO Learning tools. Registration timelines for new students required adjustment, with revised plans pending development. The board anticipated potential delays in verifying final marks for university/college admissions, contingent on prolonged downtime. Director Sheryl Robinson Petrazzini communicated updates via social media and retracted earlier instructions to use alternate phone numbers after landline functionality was fully restored. Staff requested parents report absences via phone calls or signed notes during the disruption. The incident coincided with the start of a new semester, though Gerard reported minimal operational impact due to staff adaptability. HWDSB characterized cyberattacks as an inevitability for school systems, citing recent incidents at other Ontario boards, but asserted its preparedness and defensive posture throughout the response. No restoration timeline or attacker attribution was disclosed.