Families may have lost money in cyberattack on major Ontario school board

Some students and families in Mississauga, Brampton and Caledon may have fallen victim to a scam after hackers gained access to Peel District School Board email accounts and used them to send fraudulent offers for vehicles and other items.

In a notice sent to families Thursday (June 18), the board — Ontario’s second largest with 148,000 students — revealed that a small number of staff email accounts were compromised and then used to send bulk emails to students advertising items for sale.

While officials did not say how many people may have been affected, the board acknowledged that some community members interacted with the emails, including making payments and travelling to the board’s headquarters in response to the bogus offers.

The admission raises concerns that the scam may have resulted in financial losses for some families.

According to the board, the emails were part of a targeted financial scam and were designed to appear legitimate because they originated from compromised school board accounts.

Among the items being advertised were vehicles, although officials said none of the offers were genuine.

“The school board does not sell or broker personal goods,” the board said, stressing that the emails did not represent legitimate communications from the organization.

The board’s cyber security team said it moved quickly to contain the breach after discovering the incident. Officials secured the affected accounts, blocked malicious domains linked to the scam and removed fraudulent emails from school board systems.

Families are being urged to delete any emails offering vehicles or other items for sale that appear to come from school board accounts and to avoid responding to them.

Anyone who sent money or shared personal information is encouraged to contact their financial institution immediately, report the incident to Peel Regional Police and file a report with the Canadian Anti-Fraud Centre.

The Peel District School Board said it regrets the distress caused by the incident and is continuing efforts to strengthen cyber security protections for students, staff and families.