CIS Ontario Premier Sponsor, KPMG – Could Your School Keep Running After a Cyberattack?

For independent schools, trust is foundational.

Families trust schools with their children’s education and wellbeing. Employees trust them with personal and financial information. Donors and alumni entrust them with their information and contributions. Increasingly, all of those relationships depend on technology.

Student information systems, learning platforms, payroll, financial systems, admissions applications, fundraising databases, health information, email and cloud services have become part of the infrastructure required to operate a modern school.

That digital transformation has brought enormous benefits. It has also created an institutional risk that school leaders and boards can no longer leave solely with the IT department: cyber risk.

Why schools are attractive targets

Cybercriminals do not necessarily choose victims because of who they are. Often, they look for opportunity.

The Canadian Centre for Cyber Security describes ransomware actors affecting Canadian organizations as overwhelmingly financially motivated and opportunistic and warns that organizations of every size and sector are at risk.

Schools present an attractive environment because of the combination of information and access they manage.

Consider the information that may exist across a school’s systems: student and parent information, academic records, employee and payroll data, banking details, health or accommodation information, admissions records and donor information.

Then consider the technology ecosystem surrounding it. A school may rely on numerous external providers for learning management, student information, payments, communications, admissions and HR. Students and employees connect from many devices and locations, while faculty and administrators exchange large volumes of information by email.

The result is a complex digital environment, and cybercriminals need to find only one viable path into it.

The threat is closer than many realize

In 2025, a cyber incident involving an education technology provider affected school systems across North America. In Ontario, the Information and Privacy Commissioner reported that 20 school boards and the Ministry of Education reported breaches connected with the incident. The attacker gained access through compromised credentials associated with a subcontractor and obtained data held within student information systems.

The lesson extends beyond any individual provider: a school can take steps to secure its own environment and still inherit risk through organizations with access to its systems and information.

Ontario schools have also experienced ransomware attacks directly. The province’s privacy regulator reported one incident affecting more than 32,000 students, employees, families and donors. Another incident at an Ontario school board affected a test environment containing personal information relating to approximately 280,000 students and employees.

Independent schools are not outside this ecosystem. They use many of the same technologies, vendors and digital processes.

The question for leadership, therefore, is not simply, “Are we secure?”

But rather: “If something happens, how prepared are we to manage it?”

A cyber incident quickly becomes a school-wide incident

One reason cyber risk deserves leadership attention is that the consequences rarely remain within technology.

Imagine discovering on a Monday morning that critical systems are unavailable.

Could classes continue? Could employees be paid? Could the school communicate reliably with parents? Who would determine whether personal information had been compromised? Who would coordinate legal, insurance and technical resources? Who would communicate with families? What decisions would require the involvement of the Head of School or board?

Those are operational, financial, communications and governance questions, not simply IT questions.

The financial implications can also extend far beyond a ransom demand. Responding to a serious incident may require cybersecurity specialists, legal counsel, forensic investigation, communications support, system restoration and potentially identity-protection services. Business interruption can add further costs.

For an independent school, there is another consideration that is harder to quantify: trust.

Parents entrust schools with particularly sensitive information about their children. Alumni relationships may span decades. Donors expect responsible stewardship. How a school prepares for and responds to an incident can therefore have consequences well beyond its technology environment.

Start by understanding where you stand

School leaders do not need to become cybersecurity specialists. They do need enough visibility to understand whether cyber risk is being managed appropriately.

For many schools, a useful starting point is understanding their current cybersecurity posture. A cybersecurity assessment can provide a structured view of where the school is today, what protections are already in place and where potential gaps or areas of greater risk may exist.

Importantly, the purpose is not simply to produce a technical list of vulnerabilities. A useful assessment should help leadership understand how cybersecurity capabilities align with the risks that matter to the school, identify priorities and make more informed decisions about where time and resources should be focused.

Whether through a formal independent assessment or an internal leadership discussion, five questions can provide a useful starting point:

1. What information would cause the greatest harm if it were stolen or unavailable?
   Schools need to understand what sensitive information they hold, where it resides and how long it is retained.

2. Who has access to our most important systems?
   That includes employees, administrators and external service providers. Access that was appropriate several years ago may no longer be necessary today.

3. How do we manage third party dependencies?
   Schools should know which providers hold sensitive information or have privileged access, and what would happen if one of them experienced an incident.

4. Could we continue operating if key systems were unavailable?
   Backups matter, but resilience also means knowing how critical school functions would continue while systems are being restored.

5. Have we practiced our response, do we have a plan?
   The middle of a cyber incident is a difficult time to determine who has decision-making authority, how families will be contacted, or when the board should become involved.

Cyber resilience is ultimately about protecting the school’s mission

Cybersecurity can easily become a conversation dominated by technical terminology: firewalls, endpoints, identity management, vulnerabilities and threat detection. Those things matter. But they are not the reason cybersecurity matters to an independent school.

The purpose is to protect the school’s ability to educate students, support its community, safeguard the information entrusted to it and continue operating when something unexpected occurs. That makes cyber resilience a shared responsibility.

For many schools, the most important first step is therefore not purchasing another security product. It is understanding their current level of preparedness, identifying where control gaps may result in risk, and using that understanding to determine what should be prioritized.

Cyber incidents may be increasingly difficult to avoid entirely. Being unprepared for one does not have to be.

Where to start

Understanding where your school stands today can make cybersecurity investment more focused and practical. A cybersecurity maturity assessment can help establish a baseline, identify priority gaps, and provide a roadmap for strengthening resilience over time.

Combined with an incident response plan, it can help answer two fundamental questions: How prepared are we today, and what should we do next?

Learn more about KPMG in Canada’s cybersecurity services.

If your organization is experiencing a cyber incident or has questions about incident response, KPMG’s cyber incident response specialists are available 24/7 at cyberincident@kpmg.ca