Cybersecurity for Canadian Schools and Universities

Ransomware and data breaches in Canadian education: what the numbers show

• The Toronto District School Board confirmed in 2023 that it was affected by a data breach involving student records, one in a string of incidents that have made Canadian K-12 boards among the most often compromised public institutions in the country.
• The TDSB serves over 240,000 students, and its breach illustrated a pattern common across large boards: sprawling legacy infrastructure, thousands of staff endpoints, and student information systems that are directly internet-accessible or thinly protected behind VPNs with weak authentication.
• The CCCS has issued multiple advisories specifically calling out K-12 education as a priority target, noting that Canadian school boards process large volumes of minor PII, date of birth, home address, health accommodation notes, that has direct value for identity fraud and is often stored in systems that haven't been patched in years.
• CIRA's Canadian Internet Security survey data consistently shows that education ranks among the sectors reporting the highest rates of successful cyberattacks.
• The reasons are structural.
• School boards and post-secondary institutions operate with IT-to-user ratios that would be considered dangerously understaffed in any private sector equivalent.
• A board serving 50,000 students might run a central IT team of 8–12 people responsible for hundreds of locations, aging network switches, and classroom devices that are reimaged annually but never hardened.
• University research environments compound the problem: researchers demand open network access, run unmanaged lab devices, and often process sensitive datasets, genomics, clinical trial records, national security-adjacent research, on equipment that IT has no visibility into.
• Ransomware groups time their attacks against education institutions with deliberate precision.
• Attacks against school boards often occur in the weeks before provincial standardized testing or in late August before the academic year begins, maximizing operational pressure on administrators.
• University attacks cluster around January and April exam periods when downtime is most damaging and the likelihood of paying is highest.
• The 2021 ransomware attack on the Newfoundland and Labrador health sector, which disrupted chemotherapy scheduling, shown the real-world harm potential when critical-service organizations lack adequate recovery capability.
• Education institutions with research hospitals or clinical training programs face comparable stakes.
• Post-secondary institutions managing federally funded research face an more dimension: intellectual property theft.
• Canadian university research labs in quantum computing, clean energy, AI, and advanced manufacturing are targets for state-affiliated actors who use spearphishing, compromised research collaboration portals, and supply-chain attacks through academic publishing platforms.
• The RCMP and CSE have both issued public guidance to the research sector about foreign interference risks, noting that nation-state actors specifically target graduate students and visiting researchers as vectors.
• A research data breach at a Canadian university may trigger obligations not only under PIPEDA but potentially under federal national security frameworks if the research involves controlled or export-restricted technologies.

Which privacy law governs which institution