Dear Parents/Guardians and Students:
We are writing to inform you of a security incident at Toronto District School Board (“TDSB”). This notification is provided pursuant to the Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 (“MFIPPA”).
On October 6, 2023, TDSB IT Services and Freedom of Information and Privacy Office learned that there had been unauthorized access to a staff member’s device containing various student and staff records. Due to an information security incident involving some of TDSB’s computer systems, some sensitive personal data may have been rendered insecure. After a review of our systems, we discovered that your information might be among the affected data. The personal information that was accessed without authorization may have included your first and last name, TDSB student number, Ontario Education Number, date of birth, email address, student’s phone numbers, who wrote the Ontario Secondary School Literacy Test and Education Quality and Accountability Office tests, and their parent’s contact information, who used the online booking system to book teacher-parent interview (first and last name, email, phone number).
While we are confident the risk to you is low, as we have not found or received reports of actual or suspected misuse of the personal information, we want to share this with you out of abundance of caution and our commitment to full transparency. We have addressed this incident with the assistance of law enforcement and computer security specialists. This security incident was also reported to the Information and Privacy Commissioner of Ontario and Toronto Police Service. In addition, we have conducted a thorough review of TDSB’s systems and implemented additional security measures designed to prevent a similar incident from happening again and to protect the privacy and personal information of TDSB’s students, parents and guardians. Our investigation is completed.
Please note that you may file a complaint with the Information and Privacy Commissioner of Ontario if you choose to do so. An online form is available on the Information and Privacy Commissioner of Ontario website at https://www.ipc.on.ca/guidance-documents/forms/file-a-privacy-complaint-under-fippa-mfippa/.
Please be assured that we continue to take data security and confidentiality very seriously. All staff are required to complete mandatory privacy and cyber training to support them in their roles, and we have a robust system in place to manage and learn from significant events. We regret that this error occurred and may cause you some inconvenience or concern, but we want to assure you that we are committed to protecting the privacy and security of your personal information. If you have any further questions, please contact your school administration.