Manitoba school cyberattack: Another wake-up call for education

Schools depend on technology for nearly every part of their day-to-day operations, from classroom learning and communications to administrative systems. That makes the recent cybersecurity incident affecting Garden Valley School Division in Manitoba another important reminder that educational institutions need to be prepared for cyber disruption.

According to a recent CBC News article, the school division, based in Winkler, Manitoba, began experiencing network disruptions on Oct. 25. Four days later, it announced that the disruptions were the result of a cybersecurity incident. As a precaution, systems were taken offline while an investigation began. CTV News also reported on Oct. 30 that the school division attributed the network disruptions to a cybersecurity incident. 

The full extent of the incident remains under investigation. Garden Valley School Division said it is assessing whether any data was compromised and will notify affected individuals if personal information is found to have been exposed. The division has also reported the incident to the appropriate authorities and brought in third-party cybersecurity experts to help contain the incident and safely restore its systems.

The incident illustrates an important reality: A cyberattack on a school is not simply an IT problem.

Garden Valley School Division reported that phone systems were quickly restored, but disruptions to normal activities were expected to continue while teams worked to restore other systems. Its Superintendent said systems would not be brought back online until the division could be confident in their integrity.

That approach highlights why cyber resilience matters alongside cyber protection. Organizations must work to prevent attacks, but they also need the ability to respond to incidents and restore trusted systems when disruption occurs.

For schools in particular, technology downtime can affect the people and processes that depend on digital services every day. Cybersecurity planning therefore needs to account not only for preventing threats but for maintaining continuity when an incident occurs.

The Garden Valley School Division incident is not isolated. Manitoba has experienced several other significant cyber incidents involving education.

Two other reported cyber incidents, occurring on separate occasions, targeted Manitoba-based educators: one in September 2026 and another two years prior. The attacks caused campus-wide outages, resulting in class cancellations. 

It's an important reminder that educational institutions need to think beyond individual security tools. Cyber resilience requires layers of protection, strong security practices and a tested approach for responding when defenses are breached.

There is no single technology that eliminates cyber risk. Schools and other organizations can strengthen resilience by taking a layered approach that combines cybersecurity, data protection and recovery capabilities with good security practices.

That means reducing opportunities for attackers while also preparing for the possibility that an incident will succeed. Protecting accounts and endpoints, maintaining reliable backups, keeping systems updated, educating users about cyberthreats and having an incident-response and recovery plan all contribute to that broader goal.

The situation in Manitoba is still developing, and the investigation will ultimately provide a clearer picture of its impact. What is already clear is the wider lesson: Schools cannot treat cybersecurity as an issue that begins and ends with prevention.

Cyber resilience means being prepared not only to stop attacks, but also to keep essential operations moving and recover safely when disruption occurs.