Ransomware Attack on Burnaby School District: Qilin Claims It Has Posted Student and Staff Files

The Qilin ransomware group has put data it says came from Burnaby School District in British Columbia on its dark-web leak site, CBC News reports, and the district now says "some files taken from the school district may have been included". It hasn't confirmed the leak, and has engaged an external expert to check. The district, which teaches about 27,000 students in 41 elementary and eight secondary schools, found the intrusion on Monday, 21 September.

What Qilin claims

CBC says it found what it describes as a hacked database stolen from the district on the group's site, with folders labelled "Harassment Investigations", "Discipline", "Payroll" and "Mental health and Wellness". The tracker Ransomware.live logged the listing, "Burnaby Schools - School District 41", under Qilin on 26 October. The district's statements don't mention a ransom demand or payment.

What the district says was taken

Its own notice calls it a ransomware attack in which "an unauthorized third party gained access to certain files". The district's FAQ, updated on 2 November, lists what may have been copied. That includes names, contact details, Personal Education Numbers, dates of birth, grade and school for 2024 and 2026, along with registration papers for students who enrolled in either year: citizenship and permanent-resident documents, visas, leases or utility bills. It also covers kindergarten assessment notes for 2021 to 2025 and lists of children receiving learning support, in some cases with a diagnosis.

Personnel records were "put at risk", the Canadian Press reported in October, and the district adds that some former employees are affected. No count of affected people has been published.

The attack took out phones across the district until 28 September, and the MyEducation family portal until 1 October. The district has reported the case to the Burnaby RCMP and to the Office of the Information and Privacy Commissioner for BC.

What the district is offering families and staff

Students have been offered registration with TransUnion's Fraud Alert Database, with details sent to parents and secondary students on 14 October; all staff were offered TransUnion's services earlier in October. Whether parents get credit monitoring depends on the nature of the information involved, the FAQ says, while the investigation goes on. Families whose children's intervention records or bus routing details may have been affected are getting separate notifications, and questions go to [email protected].