The Limestone District School Board (LDSB) in Kingston, Ontario has confirmed that a cyberattack on April 17, 2025 resulted in the theft of personal information belonging to current and former staff, most current students, and parents or guardians. The breach is notable for its scope, with stolen staff records dating back to 1998, making it one of the most extensive data exposures in the Canadian education sector.
What Happened
On April 17, 2025, the Limestone District School Board detected unauthorized access to its network. The board immediately engaged cybersecurity incident response professionals and launched an investigation. The forensic analysis determined that threat actors had gained access to internal systems and exfiltrated files containing personal information before the intrusion was contained.
The board reported the incident to the Kingston Police Service and the Ontario Information and Privacy Commissioner (IPC). While services were disrupted in the immediate aftermath, the board was able to restore most systems within weeks of the attack.
Scope of the Data Exposure
The breadth of compromised data is significant, spanning nearly three decades of records:
- Personal information of current and former staff members dating back to 1998, including names, addresses, Social Insurance Numbers, dates of birth, and employment records
- Student information for most currently enrolled students, including names, dates of birth, addresses, and student identification numbers
- Parent and guardian contact information and emergency contact details
- Some medical and special education records associated with student files
The retention of staff records dating back 27 years highlights a challenge common across the public sector: legacy data that remains accessible on modern networks long after its operational usefulness has passed.
The MUSH Sector Under Attack
The LDSB attack is part of a broader pattern of cyberattacks targeting Canada's MUSH sector, comprising municipalities, universities, school boards, and hospitals. These organizations often face constrained IT budgets, aging infrastructure, and large volumes of sensitive personal data, making them attractive targets for cybercriminals.
In recent years, Canadian school boards in Hamilton, Durham Region, and Toronto have all experienced significant cyber incidents. The education sector's reliance on shared platforms, limited security staffing, and broad user populations of students and educators creates a challenging security environment.
Response and Recovery
The Limestone District School Board has taken several steps in response to the breach:
- Restored affected systems and services within weeks of the attack
- Offered two years of complimentary TransUnion credit monitoring to affected individuals
- Established a dedicated information line for affected staff, students, and families
- Filed reports with Kingston Police and the Ontario IPC
- Engaged external cybersecurity experts to harden systems and prevent future incidents
Protecting Your Information
If you are a current or former staff member, student, or parent associated with the Limestone District School Board, CyberSafe recommends the following actions:
- Enrol in the complimentary TransUnion credit monitoring offered by the board
- Monitor your credit reports with both Equifax Canada and TransUnion for unfamiliar accounts or inquiries
- Be cautious of phishing emails or phone calls referencing the school board or your personal details
- If your SIN was potentially exposed, contact Service Canada to discuss protective measures
- Report any suspected identity fraud to the Canadian Anti-Fraud Centre
Education Sector Security Recommendations
CyberSafe advises school boards and educational institutions to strengthen their cybersecurity posture with the following measures:
- Implement data retention policies that minimize the volume of historical personal data stored on active systems
- Deploy multi-factor authentication for all staff accounts, particularly those with administrative access
- Segment networks to isolate sensitive student and HR data from general-use systems
- Conduct regular vulnerability assessments and penetration testing of internet-facing systems
- Establish incident response plans tailored to the education sector with help from security consulting services
- Invest in security awareness training for staff and educators to reduce the risk of phishing-based intrusions
Frequently asked questions
What happened in the Limestone District School Board cyberattack?
On April 17, 2025, the Limestone District School Board in Kingston, Ontario detected unauthorized access to its network. Threat actors accessed internal systems and exfiltrated files containing personal information. The board engaged incident response professionals, reported the incident to the Kingston Police Service and the Ontario IPC, and restored most systems within weeks.
What information was stolen in the Limestone school board breach?
The stolen information covers nearly three decades. It includes staff records dating back to 1998 with names, addresses, Social Insurance Numbers, dates of birth and employment records. It also includes data on most current students, parent and guardian contact and emergency details, and some medical and special education records.
What should people affected by the Limestone breach do?
The article recommends enrolling in the complimentary TransUnion credit monitoring offered by the board, which lasts two years, and monitoring credit reports with Equifax Canada and TransUnion. Affected people should be cautious of phishing emails or calls, contact Service Canada if their SIN may have been exposed, and report suspected identity fraud to the Canadian Anti-Fraud Centre.