Burnaby School District (School District No. 41) in British Columbia has confirmed that a ransomware attack found on September 21, 2026 led to personal information being "copied and stolen by the criminal actors responsible," according to the district's online incident notice. The district had more than 29,600 students last school year across 41 elementary and eight secondary schools (CBC, citing provincial figures). The stolen files may include names, contact details, birthdates, Personal Education Numbers, registration documents, kindergarten assessment notes and lists of students on specialized learning plans. CBC reports that the district's email to families also listed medical diagnoses and bus routing information as possibly exposed. No ransomware group has publicly claimed the attack, and the district has not said how many people are affected.
What Happened
The district says it found the intrusion on Monday, September 21. It contained the incident, brought in outside cybersecurity specialists and notified authorities. Superintendent Karim Hachlaf emailed families on September 22. A statement followed on the district website on September 23, and a further update came on September 25 (Freshet News, republished by Canadian Underwriter).
The operational impact was district-wide. Internal network services and phone lines went down, Wi-Fi was blocked across schools, and printers were out by Thursday, September 24 (CBC, The Canada Report). Schools changed their websites so parents could report absences, and families were told to use school email addresses while phones were offline. Chester Wisniewski of Sophos told CBC that being down for four days "does suggest that they might not have been very well prepared."
For about three weeks the district would not say whether data had been taken. Hachlaf said on September 25 that the district had "identified unauthorized activity" but had "not yet confirmed whether any personal information has been accessed." CTV News reported on September 29 that this was still unknown. The position changed on Wednesday, October 14. The district emailed families and updated its notice to call the incident a ransomware attack and confirm that files had been exfiltrated (CBC, The Globe and Mail/Canadian Press).
Phone service and some cloud-based student services have since been restored. As of CBC's October 15 report, the district had not said that internet access was fully back. The RCMP and B.C.'s Office of the Information and Privacy Commissioner are involved (Globe and Mail/CP).
What Was Taken
The district has not given a record count or a number of affected individuals. Its notice also says that "some staff and student information was placed at risk," so staff appear to be affected along with students and families.
According to the district's notice and press coverage, the affected data may include:
- General records for students, parents and guardians from the years given in the notice as "2024 and 2026": names, contact information, Personal Education Number (PEN), date of birth, grade, school and, where applicable, the Ministry designation code and description
- Student registration information, including documents that establish residency (district notice; CBC)
- Kindergarten assessment notes and student assessments (Globe and Mail/CP; CBC)
- Detailed lists of students on specialized learning plans or receiving specialized support (Globe and Mail/CP; CBC)
- Medical diagnoses (CBC, citing the district's email to families)
- Bus routing information (CBC)
The sources disagree on severity. The district's notice says the impact on students, parents and guardians "was limited" and that "most of the sensitive information" it holds "remains secure." The CBC report on the same disclosure puts medical diagnoses and residency documents at the front. Both can be true: the volume may be limited while the sensitivity is high. Until the district publishes counts, readers should not take "limited" to mean low-risk.
Why It Matters
- Children's data stays useful to criminals for years. A PEN, a date of birth and a residency document together make a strong base for identity fraud. Victims often don't find out until they apply for credit as adults.
- Medical and special-education records are a stronger extortion lever. Ransomware groups have published this kind of data from school districts in the past to pressure victims and embarrass them publicly. Lists of students with diagnoses or individual learning plans carry a lasting privacy and safety risk to families that no credit-monitoring service can fix.
- The timing fits a known pattern. Wisniewski told CBC that September is a common time to attack schools because outages at the start of term give criminals "extra leverage" for ransom demands.
- The disclosure was slow. About 23 days passed between discovery and confirmation that data was stolen. During that time families had no specific guidance beyond general warnings about scams. For defenders, this shows that exfiltration scoping needs to be fast. Regulators and parents both expect quicker answers.
The Attack Technique
The district has not said how the attackers got in, which ransomware family was used, or whether a ransom was demanded or paid. No group has been named in any of the sources reviewed. The confirmed facts point to the standard double-extortion pattern: data was stolen before or alongside encryption, and the encryption took down core network, telephony (probably VoIP that depends on the network) and print infrastructure across the whole district. Because the outage hit everything at once, the attackers probably had broad internal access, such as domain-level privileges, rather than a foothold on a single server. That is inference, not something the district has confirmed. This brief will be updated if a group claims the attack on a leak site or the district releases forensic findings.
What Organizations Should Do
- Split sensitive student records off from general file shares. Medical diagnoses, individual learning plans and residency documents should sit in access-controlled systems with logging, not on broadly reachable network drives.
- Watch for large outbound data transfers. Alert on unusual egress volumes and on the archiving and sync tools ransomware groups often use, such as rclone and MEGA clients. This catches theft before encryption starts.
- Make phones and communications survivable. Keep an out-of-band channel for absences and emergencies, such as a cloud-hosted notification platform or separate telephony, so that a network compromise doesn't cut schools off from parents.
- Lock down identity. Enforce phishing-resistant MFA on remote access, email and admin accounts. Use tiered admin accounts and audit service accounts, since domain-wide compromise is what turns one intrusion into a district-wide outage.
- Plan the September risk window ahead of time. Run tabletop exercises and test backup restores before term starts. Check that backups are offline or immutable so recovery takes days rather than weeks.
- Prepare breach-notification workflows in advance. Have data maps and legal and communications templates ready so you can confirm what was taken and notify families and regulators in days, not weeks.
Sources: Cyberattack may have leaked student and parent information, Burnaby... | Cybercriminals may have accessed medical diagnoses in Burnaby schoo... | Cyberattack on Burnaby School District triggers widespread disrupti... | Incident Impacting Operations - Burnaby Schools - School District 4... | Burnaby Schools investigating if personal data compromised in cyber... | B.C. school district investigating if personal data compromised in... | Burnaby School District Cyberattack Disrupts Services | Burnaby schools cyber incident: Unknown if personal information taken