The Burnaby School District says files stolen during a September ransomware attack may have been published on the dark web, adding a new stage to an investigation into the possible exposure of student, family and staff information.
In an update dated November 3, the district said it had received reports that the threat actor claimed to have released files connected to the incident.
An external expert has been hired to determine whether district records were included and, if so, what information was affected.
The district has not confirmed the full scope of any online publication.
Its investigation remains active, and officials say they are reviewing relevant systems and files while monitoring whether potentially affected information is circulating online.
Table of Contents
What happened at Burnaby School District
Burnaby School District discovered unauthorized access to its systems on Monday, September 21, 2026.
It said it immediately moved to contain the incident, brought in cybersecurity specialists and notified the appropriate authorities.
The district now describes the incident as a ransomware attack.
It says an unauthorized third party accessed certain files and that criminal actors copied and stole records containing personal information.
Some information about former employees was also placed at risk.
The attack initially affected internal network services, phone lines and other operations across the district.
Phone service was restored on September 28, while access to MyEducation and the family portal returned on October 1.
The district said student learning continued without disruption.
What information may be involved
The district says much of the sensitive information it holds about students and families remains secure.
However, the records under review may include information connected with students, parents and guardians in 2024 and 2026.
Potentially affected information includes names, contact details, Personal Education Numbers, dates of birth, grades, schools and certain Ministry designations.
Student registration records for people who enrolled in 2024 or 2026 may also have been involved.
Those files could contain documents used to establish residency, including citizenship documents, permanent resident records, visas, identification, leases or utility bills.
The district also identified kindergarten assessment notes and projections from 2021 to 2025 as potentially affected.
Those records may contain information about school readiness, needs and individual circumstances.
Lists of students receiving specialized learning assistance or other supports may also be involved.
In some cases, those records include a description of the support, a diagnosis or details about the nature and degree of a student’s needs.
In a smaller number of cases, the review includes bus routing information, student intervention records and other student assessments.
The district says more tailored notices will be sent to people whose information is confirmed to have been involved.
Investigation and privacy notifications continue
Burnaby School District has reported the incident to Burnaby RCMP and the Office of the Information and Privacy Commissioner for British Columbia.
The district’s frequently asked questions document, updated November 2, says specialists are reviewing technical data and records to determine which individuals and categories of information may have been affected.
Officials say notices are being issued as reliable findings are confirmed rather than relying on incomplete information.
The district also says affected people will receive a description of the information involved, an explanation of assessed risks and recommended protective steps where applicable.
The district has not said how many students, parents, guardians, employees or former employees may ultimately be affected.
It also has not confirmed that every category of information listed in its notices was actually published online.
Support available to students and staff
As a precaution, Burnaby School District offered students access to TransUnion’s Fraud Alert Database.
The service can alert participating creditors to possible fraud involving a registered student and prompt additional identity checks before credit is extended.
Staff were offered TransUnion services earlier in October, and some former employees are being contacted directly if the district determines that their records may have been involved.
The district says receiving identity-theft protection does not mean fraud has occurred.
Eligibility for additional credit monitoring or related services depends on the type of information involved and the assessed risk to the individual.
What families and employees should do now
The district is urging students, families and staff to be cautious about unexpected emails, text messages, phone calls or requests for personal information that refer to the cyber incident.
People should independently verify unusual requests through contact information obtained from the district’s official website rather than replying to a message or using a link supplied in it.
- Do not open unexpected attachments or links.
- Change passwords that may have been reused or exposed.
- Enable multi-factor authentication on important accounts.
- Review bank, credit-card and other account statements for unfamiliar activity.
- Keep copies of suspicious messages, statements and transaction records.
Anyone who believes they have experienced fraud or identity theft should contact the relevant financial institution, service provider or government agency and report the matter to police.
The district says it will continue notifying affected individuals and providing updates as the investigation determines whether stolen files were published, what they contained and who may be at risk.
Frequently Asked Questions
When did the Burnaby School District cyberattack happen?
The district discovered unauthorized access to its systems on Monday, September 21, 2026.
Has Burnaby School District confirmed that data was posted on the dark web?
The district says a threat actor claims to have published files and that some stolen files may have been included, but an external expert is still confirming the scope.
What information may have been affected?
Potentially affected records include names, contact information, Personal Education Numbers, dates of birth, registration documents, kindergarten assessments and specialized-support information.
What protection is available to Burnaby students?
Students can register with TransUnion’s Fraud Alert Database, which can prompt participating creditors to conduct additional identity checks.
What should people do if they receive a suspicious message?
Do not click links or open attachments, verify the request through official district contact information, change reused passwords and report suspected fraud promptly.
Fact-Checked: Key dates, including the September 21 incident, September 28 and October 1 service restorations, the October 14 student TransUnion offer, the November 3 incident-page update and the November 2 FAQ update, were checked against Burnaby School District’s official incident update and FAQ.
Disclaimer: The investigation is ongoing, and the district has not yet confirmed the complete scope of any information published online.