The Burnaby School District in British Columbia, Canada, was hit by a ransomware attack on Sept. 21, 2026, and a Russia-linked group called Qilin now claims to have posted stolen files on the dark web. If you are a parent or staff member, the safest steps are to treat unexpected messages with suspicion, enroll in the credit-monitoring or fraud-alert offer from the district, and watch your accounts closely. This article reflects reporting as of Nov. 5, 2026, and the situation is still developing.
What happened in the Burnaby school data breach?
According to the district’s own notice, the ransomware attack on Sept. 21 affected school websites and portals, internal network services and phone lines, as reported by The Globe and Mail. The district said it contained the incident, brought in cybersecurity specialists, and reported the matter to the Burnaby RCMP and the Office of the Information and Privacy Commissioner for B.C.
In mid-October, the district confirmed that an unauthorized third party accessed certain files and copied files containing personal information, according to CP24. The district described the impact on students, parents and guardians as “limited” and said its most sensitive information remained secure.
The story escalated this week. CBC News reported that the district emailed parents on Tuesday saying the threat actor claims to have published files and information from this incident on the dark web. CBC then located what appears to be a hacked database on a dark web site run by Qilin. CBC News has not viewed the contents of the folders. Global News reported that the district is offering credit monitoring to thousands of affected students, families and staff.
The district says it has engaged an external expert to help confirm whether data has in fact been posted on the dark web and what it contains. Until that review is finished, the claim remains unverified by the district.
What information may be exposed?
The district’s notice, as reported by CP24 and the Vancouver Sun, says the stolen files may include parent and student names, contact information, personal education numbers, birthdates, grades and schools. The district also listed kindergarten assessment notes from 2021 to 2025 and a list of students receiving specialized support. In some cases, that information included a student’s diagnosis or the degree of their needs.
CBC reported that the district’s email also flagged documentation that establishes residency, student assessments, medical diagnoses and bus routing information. In a “limited and smaller number” of cases, the district said bus routing information and student intervention records may be involved.
Staff are affected too. CBC reported that the files contain medical information, detailed learning assessments and personal information about both staff and students. One report on the leak site’s contents said screenshots showed folders labeled “Payroll” and “Harassment Investigations,” but that detail comes from a secondary outlet and has not been confirmed by the district.
Key details at a glance
| Organization | Burnaby School District (School District 41), British Columbia |
| Attack discovered | Sept. 21, 2026 |
| Group claiming responsibility | Qilin, a ransomware group believed to operate from Russia |
| District size | More than 29,600 students; 41 elementary and eight secondary schools |
| Data that may be affected | Names, contact details, birthdates, personal education numbers, assessments, some medical diagnoses, bus routes, residency documents |
| Authorities notified | Burnaby RCMP; B.C. Office of the Information and Privacy Commissioner |
| Support offered | Credit monitoring / TransUnion fraud alert registration |
| Dark web claim | Reported Nov. 3-4; district is verifying with an outside expert |
How to protect yourself from phishing
Criminals who hold names, phone numbers and details about a child’s school can write messages that look very real. A security expert told CBC that attackers in school cases try to pressure staff and parents. Related incidents have already shown the risk: after a separate breach in the Central Okanagan, one parent said an email from the district looked legitimate until a family member spotted it as a likely scam.
- Do not click links or open attachments in unexpected emails or texts, even if they mention your child’s school or teacher.
- Verify by another route. Call the school or visit the district website directly instead of replying to a message.
- Never share passwords, banking details, Social Security or Social Insurance numbers, or one-time codes with anyone who contacts you first.
- Be wary of urgency, such as threats to release a child’s records unless you pay or act fast.
- Turn on multi-factor authentication for email, banking and school portal accounts, and change reused passwords.
- Warn older students. Teens are often targeted by messages that reference their grades or schools.
How to guard against identity theft
The district has said staff, students and families were offered registration with TransUnion’s fraud alert service and urged to be careful with suspicious communications. Accept the offer using the instructions in the district’s notices and emails, and keep the enrollment details.
- Check credit reports regularly. If you also have a U.S. credit history, you can get free reports at AnnualCreditReport.com.
- Ask about a credit freeze or fraud alert. Children’s files are usually empty, so any activity under a minor’s name is a red flag. Contact the credit bureaus about child-specific protections.
- Monitor bank and card statements and set up transaction alerts.
- Keep records of suspicious messages and any unusual account activity, and report fraud to your bank and local police.
- Staff: pay attention to payroll, benefits and tax-related accounts, and report anything odd to your employer’s HR or IT team.
Medical and learning-support details cannot be changed like a password. Families should be extra cautious with any caller or message that references a child’s health or special education needs.
Frequently asked questions
Was my information definitely leaked?
Not necessarily. The district says files were copied and that information “may” be affected, and it has not yet confirmed what appears on the dark web. Assume you could be affected if you are connected to the district, and act accordingly.
Who is Qilin?
Qilin is a ransomware group believed to operate from Russia. Reports describe it as a “ransomware-as-a-service” operation that supplies tools to criminals in exchange for a share of extortion payments.
Should I pay anyone who contacts me about the leak?
No. Do not pay or reply to anyone claiming to hold your child’s data. Report the contact to the district and police.
Where can I get official updates?
Use the Burnaby Schools website and the emails the district sends to families, and be cautious of lookalike messages. The district’s news page lists coverage, and CBC’s report on the Qilin posting has the latest on the dark web claim.
Discover more from NewsNation Online
Subscribe to get the latest posts sent to your email.
आपके लिए सुझाव
Leave a Reply