Cyberattacks, like the recent incident affecting GTA school boards, will become all too common this year, says a University of Guelph cybersecurity researcher.
Dr. Ali Dehghantanha is a professor in the School of Computer Science and the Canada Research Chair in Cybersecurity and Threat Intelligence.
He notes the educational sector is becoming a more attractive target for cybercriminals.
“We’re seeing this trend because of the rapid digitization of educational resources, the use of outdated systems and limited cybersecurity budgets within school boards,” says Dehghantanha.
To tackle these risks, he says, educational institutions must invest in robust cybersecurity measures.
“I would recommend regular system updates, comprehensive staff training and the implementation of advanced threat detection systems,” he says. “Collaborating with cybersecurity experts and law enforcement agencies is also crucial.”
The recent cyber incident affecting the Toronto District School Board (TDSB), along with Peel and York school boards, appears to be a ransomware attack, according to Dehghantanha.
In these attacks, malicious actors infiltrate an organization’s network, encrypt critical data and demand a ransom to restore access. They compromise sensitive student information, including names, grades, email addresses, student numbers and dates of birth.
These breaches occur because of vulnerabilities in cybersecurity infrastructure.
“Attackers may exploit outdated software, weak passwords or insufficient network defenses to gain unauthorized access,” he says. “In the case of TDSB, the attackers accessed a separate testing environment used by IT services to test programs before deployment.”
The recent incident follows other notable cyberattacks on Canadian school boards.
In December 2022, the Durham District School Board experienced a significant cyberattack that disrupted phone and email systems and led to the suspension of online classes.
Similarly, in June 2024, the Cowichan Valley School District in British Columbia faced a cyber incident that resulted in the loss of internet access and website functionality.
Dehghantanha is the program director of the new Master of Cybersecurity Leadership and Cyberpreneurship (MCLC), which trains cybersecurity business leaders and launches fall 2025.
He is available for interviews.
Contact:
Dr. Ali Dehghantanha
adehghan@uoguelph.ca