The Burnaby School District in British Columbia experienced a ransomware attack on September 21, 2026. The attack is suspected to have been carried out by the Russian hacker group Qilin, which claims to have posted sensitive data on the dark web.
Qilin alleges that the leaked data includes personal information of students and staff, potentially comprising medical information, payroll data, and details from harassment investigations. The data has reportedly been accessed nearly 4,000 times since its posting on October 15.
The Burnaby School District has restored most operational services affected by the attack, including phone lines and access to educational systems. Phone services were restored by September 28, and access to the MyEducation system was restored by October 1.
External cybersecurity experts have been engaged by the district to assess the breach's extent and verify claims of data publication. The district is offering credit monitoring to affected former employees and is in direct contact with them to inform them of potential risks.
The incident has been reported to the Burnaby RCMP and the Office of the Information and Privacy Commissioner of British Columbia. The district has warned former employees that their personal information may have been compromised.