SUDBURY—A letter to parents and guardians of children in the Rainbow District School Board (RDSB) sent out last Thursday morning confirmed that a cyber incident that occurred on Friday, February 7 resulted in “sensitive data” being stolen from the board’s network. The matter is now being treated as a cyber-crime by the Greater Sudbury Police Service and Ontario Provincial Police (OPP). Those affected include current and former employees of the board, as well as students, parents, and guardians.
“We take this matter very seriously and apologize to all those who are affected,” the RDSB letter reads. “We understand this news will be as concerning to you as it is to us, and we are deeply sorry.”
Officials with the two Rainbow local teacher unions said that this news is causing an uneasy feeling for the employees it represents, and that the majority of high school teachers who have been with the board faced a similar situation about three years ago.
“I can say that we know as much as members of the public and staff know,” said Eric Laberge, District 3 president of the Ontario Secondary School Teachers Federation (OSSTF) last week. “We are aware of the information that has been shared by the school board, and we have had a couple of our members reach out today (Wednesday) with concerns.”
“The majority of OSSTF members about three years ago went through a similar cyber incident,” said Mr. Laberge. “The majority of members except for those who have been with OSSTF the past three years have seen this story already. But it does not mean this is less serious.”
Liana Holm, president of the Rainbow Local Elementary Teachers Federation of Ontario (ETFO) said the news, “is creating a very uneasy feeling for our teachers who have or may be affected by this because some personal information may have been breached.”
“The board is trying to put things in place to help assist and protect members, and members need to be vigilant in looking at their own financial information and make sure everything is in order,” said Ms. Holm.
Mr. Laberge said, “we are recommending that members heed the advice being provided by the board and that members need to take this issue seriously and look into their own personal situation, and make sure they protect themselves.”
In a facts page released by the board it states, “We are currently working with experts to determine the origin and cause of the incident. Our legal counsel from the law firm BLG has retained Kroll, and they are advising us together. The investigation continues.”
Who has been affected?
All students who graduated from Rainbow Schools from June 2012 to June 2024. Potential compromised data includes date of birth, gender, home address, parent/guardian named and contact information, academic achievement data and Ontario Education Number.
Current and former students with an identified exceptionality who have been enrolled in an intensive support program in Rainbow Schools since 2019, have been affected. The potential compromised data includes being identified with an exceptionality, assessment information, medical diagnosis and information about related needs, including accommodation and student support information, behavioural information and health card number.
Parents or guardians of the students belonging to the groups identified above have also been affected. Contact information (including phone numbers, home addresses and email addresses) and place of employment information have potentially been compromised.
Former students who were enrolled in a Rainbow School since 2011 who received a scholarship and a T4A for income tax purposes have potentially had their social insurance number compromised.
School photos from the 2012-2013 school year and including the 2024-2025 school year without student names have been potentially affected. There are no personal identifiers (student names) attached to the school photos.
All staff members currently employed by RDSB as well as individuals who worked for the board between January 2010 and February 2025 have also had data potentially compromised as well. The data includes access and primary phone number (2010 onward); social insurance number (2012 onward), bank account number (August 2017 onward; employee ID/compensation and benefit information/Ontario Ministry of Education number and police background check information (September 2018 onward).
For some current and former employees, the stolen data also includes medical information.
Should you experience fraud you believe is linked to the cyber incident report it immediately by emailing cyberincident@rainbowschools.ca.
RDSB states it will provide a two-year TransUnion credit monitoring service, free of charge, to all current and former staff whose personal information was compromised.
RDSB is also encouraging parents and former students to sign up for credit monitoring, regularly check bank accounts and credit card statements for unauthorized transactions.
Those wishing to file a complaint with the Information and Privacy Commissioner Ontario can visit the website at www.ipc.on.ca.
“Our investigation with third party experts is ongoing and we will provide further notifications, as required,” the RDSB letter added. “RDSB will continue to provide updates on the board website.”
The RDSB said there is no evidence of grade tampering, and they have no concerns with accurately reporting grades for university or college applications. The board also noted that there is no evidence that the data has been published anywhere. The possibility, however, remains.
“We are still recovering, through schools are operating without any significant disruption,” the board said.
