P2021-ND-278

The Organization uses a Learning Management System (LMS), hosted by a third party service provider, Steppingstones Partnership, Inc. (Steppingstones). Steppingstones leases web servers and services from another third party, Web Hosting Canada. On October 14, 2020, Steppingstones received a notification from Web Hosting Canada concerning a security issue impacting one of their services. Several law enforcement agencies also discovered the incident on October 14, 2020, via a tweet that identified the compromised web address, and notified the Organization. On the same day, the Organization?s third party service provider took action to quarantine several malicious files and investigate. It found that an unauthorized party uploaded several malicious executable files to the Organization?s LMS on October 13, 2020. The Organization was not able to determine how the unauthorized actor breached the environment.