Burnaby School District Confirms ransomware attack as Qilin claims data leak

Burnaby School District said it confirmed a ransomware attack on Sept. 21, 2026, after discovering that outsiders had gained unauthorized entry to its systems.

Information that may have been affected includes names and contact details, Personal Education Numbers and birthdates for 2024 and 2026, as well as grades, schools and Ministry designation codes. Registration packets for enrollees in 2024 or 2026 may have been affected, including residency documentation such as citizenship papers, visas, leases or utility bills.

It is possible that notes and projections concerning kindergarten assessments from the years 2021 to 2025 were affected. Records identifying students who receive specialized learning support, sometimes with brief descriptions of needs or diagnoses, may have been affected. In a limited number of cases, bus routing details, student intervention files and further assessments were also involved.

Files belonging to some former employees were involved, and the district is contacting those people directly. On Oct. 26, 2026, the district sent former employees a letter warning of possible exposure of their personal information, and it offered free credit monitoring and identity theft protection for 24 months.

The district said the impact on students, parents and guardians was limited, with most sensitive information tied to those groups still secure. Phone service returned to every school and district site on Sept. 28, 2026, and MyEducation access, including the family portal, was restored on Oct. 1, 2026. Student learning continued without interruption while systems were restored.

District officials told the Burnaby RCMP about the breach and notified British Columbia’s privacy body, the Office of the Information and Privacy Commissioner for British Columbia. The district brought in an outside specialist to check whether any stolen files had appeared online and to gauge the scope of affected information. The district has not publicly identified those behind the intrusion, calling them only criminal actors behind a ransomware attack. The district says the investigation remains open, and a continuing review may identify affected individuals once findings are confirmed.

The district said Qilin’s claim that it placed the district on its leak site and published stolen files remains under review. Believed to be based in Russia, Qilin is an established ransomware cartel that uses double-extortion methods against public-sector and education targets, which means stealing data and threatening to publish it. The district’s outside specialist is still checking Qilin’s leak-site claim.

Education networks remain a frequent target for ransomware crews. Qilin led all ransomware strains with claims against educational institutions in Q3 2026; five of 12 total claims were confirmed. The district runs 41 elementary and eight secondary schools for over 29,600 students, according to B.C. government figures cited by CBC.

Ransomware attacks against the education sector climbed 54 percent in Q3 2026. There were 50 attacks in Q2 2026, compared with 77 attacks in Q3 2026. Canada recorded six attacks in Q3 2026, ranking second among countries, a 500 percent increase from one attack in Q2 2026.

On Oct. 20, 2026, Comparitech reported that the median ransom demand for the education sector fell slightly to $510,000 in the third quarter of 2026. The report covered third-quarter ransomware statistics, trends and figures for educational institutions around the world.

Chester Wisniewski of Sophos said that stolen personal information helps threat actors carry out secondary attacks and that phishing messages become more credible when they cite sensitive details. “They know your child’s age, medical conditions, or different things that allow them to impersonate an official.” People harmed by breaches face a greater chance of phishing because crooks use stolen details to take money, according to the Canadian Anti-Fraud Centre.

Families and staff should be cautious about unexpected requests for personal information, use unique passwords, enable multifactor authentication where available and report suspected fraud, the district says. People should monitor bank and card statements, set transaction alerts and report suspected fraud to financial institutions and police, according to guidance cited by Cybersecurity Canada. Registration for the TransUnion Fraud Alert Database was offered to staff on Oct. 1, 2026, with students and families receiving the same offer on Oct. 14, 2026.

A reporting hotline at 1-888-495-8501 is available from the Canadian Anti-Fraud Centre for people who suspect fraud or misuse of personal details, Cybersecurity Canada said on Oct. 15, 2026. Cybersecurity Canada offered the hotline as part of advice and contact resources for families affected by the district’s data breach. Under British Columbia’s Freedom of Information and Protection of Privacy Act, school districts must notify the OIPC when a breach risks significant harm.