Cyber Incident Victim: Limestone District School Board
Date:
Apr 2025
Location:
Canada
Summary
The Limestone District School Board is dealing with a network disruption caused by a cyber incident that has cut off internet access across all its schools while keeping buildings open for instruction. The outage has also affected many school telephone systems, prompting the board to advise families to contact schools by phone rather than email and to use a list of alternate numbers for those lines that remain operational.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 1 2025 the Limestone District School Board announced that it was experiencing a network disruption caused by a cyber incident that affected all of its schools. The disruption resulted in a complete loss of internet access across the board while school buildings remained open for instruction. Email services to school offices, principals and teachers were unavailable, prompting the board to advise families to contact schools by telephone instead of using electronic mail. The notice emphasized that students who would be absent or families needing to reach a school should call the school directly.
In response to the outage the board posted an update on its main website that included a revised contact list for schools. The list showed that certain telephone numbers had been impacted by the network disruption, those numbers being marked with an asterisk, and provided alternative phone numbers for each affected site. The board instructed callers to use the numbers supplied in the update and reminded them not to attempt email communication until the network was restored. The update also reiterated that all schools continued to operate normally despite the lack of internet connectivity.
The notice did not specify the nature of the cyber incident, the timeline for restoration, or any details about attacker activity, detection or containment efforts. It confirmed that the disruption was board‑wide and that the primary impact was on internet‑based services and some telephone lines, with the board’s immediate response focused on maintaining communication pathways through the published phone alternatives. The board indicated that further information would be shared as the situation evolved.