Burnaby School District ransomware attack: student and staff data may be on dark web
A ransomware attack on Burnaby School District discovered September 21 exposed student registrations, kindergarten assessments and staff personnel records. Former employees received letters in late October.
Long read. The subject the most local outlets covered that day, with the public record behind it. Every outlet and record is linked under the story. Read the original report on burnabyschools.ca.
Criminals broke into Burnaby School District's computer systems in September, copied files containing student registrations, kindergarten assessments and staff personnel records, and may have published some of that data on the dark web. CityNews Vancouver reported on November 5 that the district sent letters to former employees warning them of the breach. The district's own notice, updated November 4, confirms that files about former staff were among those affected.
The attack has been reported to Burnaby RCMP and to BC's privacy watchdog. The investigation is ongoing.
What happened
Burnaby School District's notice on its website says the attack was discovered on Monday, September 21, 2026. The district describes it as a ransomware attack: criminals gained access to its systems, copied files, and threatened to publish the stolen data unless paid.
The district says it immediately hired cybersecurity specialists, contained the attack, and notified law enforcement and the Office of the Information and Privacy Commissioner for BC. Phone lines were restored at all schools by September 28. Access to MyEducation, the family portal used by parents to track attendance and grades, was restored on October 1. The district says that throughout this period, staff worked to keep student learning uninterrupted.
The notice was originally posted on September 23. The district updated it on November 3 and again on November 4 to reflect the confirmation that stolen files appear to have been published on the dark web.
What information was taken
The district's notice lists the categories of information that may have been affected.
For students, parents and guardians enrolled in 2024 and 2026: names, contact information, Personal Education Numbers, dates of birth, grades, schools and Ministry designation codes. Student registration documents from those years are also included. Because families must prove residency to register a child, those documents can include identity papers such as citizenship certificates, permanent resident cards, visas and leases.
For younger students: kindergarten assessment notes and projections from 2021 to 2025, which record a child's readiness for school and any needs or complexities noted by educators at the time.
For students receiving extra support: lists of students with specialized learning assistance, including in some cases diagnoses and descriptions of their needs and complexities.
The district says a smaller number of files also included bus routing information, student intervention records and other student assessments.
The district says most of the sensitive information it holds about current students, parents and guardians remains secure, and that the impact on that group was limited compared with the impact on former staff.
Former staff notified directly
Files about former employees were among those stolen. CityNews Vancouver reported on November 5 that the district sent a letter to former staff in late October, warning them that personal information in their personnel records may have been exposed. The letter, dated October 26, was quoted in the CityNews Vancouver report.
"The threat actor has threatened to and may have published some of the stolen information on websites used by cybercriminals to distribute unlawfully obtained data," the district wrote in its letter, as quoted by CityNews Vancouver. "As a result, we cannot rule out the possibility that information relating to you has been exposed to unauthorized individuals."
The district's notice says it is contacting former staff directly. Former staff, like current staff and students, have been offered TransUnion's credit and fraud monitoring services.
Is the data on the dark web
The district says it has received reports that the criminals have published files from the attack on websites that criminal groups use to distribute stolen data. Its November 4 notice says it has reason to believe some of those files are from the school district.
The district has hired an external expert to confirm whether that is the case and what information is in those files. As of November 4, that review was still in progress. The district says it will keep the community updated as the investigation proceeds.
What the district is offering
The district moved in stages to protect people whose information was at risk.
Current staff were notified on October 1 that personnel records had been placed at risk and were offered TransUnion's services. On October 14, the district offered all students registration with TransUnion's Fraud Alert Database. That service notifies creditors to take extra steps to verify identity before extending credit in a registered student's name.
Former staff whose information was affected have also been offered credit monitoring for 24 months at no cost.
The district says these services were offered as a precaution. Making the offer does not mean every person's information was accessed or published.
What families and former staff can do
The district advises everyone connected to Burnaby Schools to:
- Watch for suspicious emails, phone calls and text messages, especially any that ask for personal information
- Check financial accounts for unusual activity
- Be cautious with any unexpected communications
Families who have not yet registered for TransUnion's Fraud Alert Database can find information through the district's website. Former staff who received a letter and have questions about the services offered are asked to contact the district directly.
The district's full notice, including answers to frequently asked questions, is at burnabyschools.ca/incident-impacting-operations.
The new school board trustees
The seven school board trustees for School District 41 were elected on October 17, 2026: Bill Brassington, Colin Zuo, Hillary Bergshoeff, Jen Mezei, Kristin Schnider, Paul Kwon and Stephen Andrada. They took office while the district was actively managing the investigation and reaching former staff. Six of the seven ran with the Burnaby Citizens Association, whose 2026 platform includes a commitment to set clear rules, with teachers, support staff and their unions, for protecting student data in schools. That commitment was made before the ransomware attack became public. The breach adds weight to the question of how the new board will approach the security of the information the district holds.
Residents can follow developments at the Board of Education's page on the voche.me Burnaby tracker at /bc/burnaby-2026/tracker.
Questions this story answers
When did criminals break into Burnaby School District's computer systems?
Burnaby School District says it discovered the attack on Monday, September 21, 2026. The district's own notice describes it as a ransomware attack in which an unauthorized third party gained access to and copied files from the district's systems. The district says it immediately took steps to contain the attack and hired cybersecurity specialists.
What information was taken from Burnaby Schools?
According to the district's notice on its website, the stolen files may have included: general information about students, parents and guardians from 2024 and 2026 (names, contact details, Personal Education Numbers, dates of birth, grades and schools); student registration documents from 2024 and 2026, which can include identity and residency documents such as leases and citizenship papers; kindergarten assessment notes and projections from 2021 to 2025; and lists of students receiving specialized learning support, including in some cases diagnoses and descriptions of student needs. A smaller set of files also included bus routing information, student intervention records and other student assessments.
Is the stolen data on the dark web now?
The district says it has received reports that the criminals responsible have published files from the attack on websites used by criminal groups to share stolen information. Its notice says it has reason to believe some of those files are from the school district. The district has hired an external expert to confirm whether that is the case and what information is included. As of November 4, that investigation was still in progress, and the district said it would keep the community updated.
Who was directly notified about the data breach?
CityNews Vancouver reported on November 5 that the district sent letters to former employees warning them their personal information may have been exposed. The district's own notice says files about former staff were among those affected, and that the district is contacting former staff directly. All current staff were notified on October 1 that personnel records had been placed at risk. All students were notified on October 14 when the district offered them TransUnion fraud protection services.
What is the district offering to affected families and staff?
The district's notice says it offered all students registration with TransUnion's Fraud Alert Database on October 14. TransUnion notifies participating creditors to take extra steps to verify identity before extending credit in a registered student's name. Former and current staff have also been offered TransUnion's credit and fraud monitoring services. These services are offered as a precaution, and the district says they are available to all students, not only those whose information is confirmed stolen.
Has the attack been reported to police and the privacy commissioner?
Yes. The district's notice says it reported the attack to Burnaby RCMP and to the Office of the Information and Privacy Commissioner for BC. The investigation is ongoing. Phone service at all schools was restored on September 28 and access to the MyEducation family portal was restored on October 1. The district says throughout this period, staff worked to keep student learning uninterrupted.
What should Burnaby families do right now?
The district advises everyone in the Burnaby Schools community to watch for suspicious emails, phone calls or text messages, especially any that ask for personal information. It also advises checking financial accounts for unusual activity. Families who have not yet registered for TransUnion's Fraud Alert Database can find information on the district's website at burnabyschools.ca. Former staff who received a letter and have questions about the services offered are asked to contact the district directly.
What does this mean for the school board trustees elected in October 2026?
The seven school board trustees elected on October 17, 2026 took office as the district was managing the investigation and notifying former staff. The Burnaby Citizens Association's 2026 platform, which six of the seven trustees ran on, includes a promise to set clear rules for protecting student data in connection with artificial intelligence in schools. That promise was made before the ransomware attack became public, and the breach adds urgency to the question of how School District 41 handles and protects sensitive information.
Sources
The pages this story draws on. Open one to check a claim yourself.
- Burnaby Schools: Incident Impacting Operations (updated November 4, 2026)burnabyschools.ca
- CityNews Vancouver: Burnaby school district warns former staff of data breach in cyberattack (November 5, 2026)vancouver.citynews.ca
- Office of the Information and Privacy Commissioner for BCoipc.bc.ca
- Burnaby RCMP Newsroomrcmp.ca
Found an error? Tell the editors with the corrections form. A correction is noted on the story it changes. Read our standards.
