Data of 70,000 students stolen during hack: WRDSB

Waterloo Region District School Board (WRDSB) says they’ve confirmed the data of around 70,000 students was stolen during a cyberattack nearly three months ago.

The database accessed included information for students enrolled in the 2006/2007 through 2012/2013 academic years, the board said in a statement posted on their website. Given the years, most people affected are former students.

According to the board, data taken “may have included” names, birthdates, whether the student had an individualized education plan, and historical education information like former teachers and schools. It did not include social insurance numbers, addresses or financial information, the board said.

“We understand that students, former students, parents and caregivers are concerned about their personal information and that of their loved ones,” Eusis Dougan-McKenzie, WRDSB interim chief communications officer, said in the statement. “We also know the time this process has taken has added to the stress.”

In August, the board said some student information was accessed during the July 10 hack, which also saw staff data – including SIN numbers – stolen. Until now, it has not provided any details on what type of student information was compromised.

“Unfortunately, at that time we did not know precisely which students or what information was involved. We requested your patience and trust as we undertook the complex and time-consuming analysis of this data,” Dougan-McKenzie said. We have now completed a significant portion of that work, and can now share the results.”

The board said cyber security experts have determined the hack did not include its main student information system, rather data from 2006/2007 through 2012/2013 academic years. Not all students registered in that period of time were impacted, the board said.

The board said the risk of identity theft is “very low,” but it is offering free credit monitoring to anyone in the dataset.

Credit monitoring is a service that notifies people about unusual banking activities.

The board also said they have received "assurances" that any copies of the stolen data have been deleted.

The school board declined CTV Kitchener’s request for an interview.

This is a developing story and will be updated.