The personal information of students, parents and staff were stolen by “criminal actors” during a ransomware attack on Burnaby, B.C., school systems last month, the district has confirmed. On Sept. 21, the district says an unauthorized third party accessed certain files its systems and while officials “acted quickly to respond and contain the incident,” files containing personal information were copied. The district says stolen information may have included the names of parents and students for 2024 and 2026, contact information, students’ personal education number, their date of birth, their grade and school. Documents submitted to confirm residency such as citizenship, PR or visas may have been taken from students who enrolled in 2024 or 2026. Kindergarten assessment notes from 2021-2025 that include information about students’ readiness for school and their needs or complexities were also affected, as well as a list of students receiving specialized assistance or supports. In some cases, the district says that information included a student’s diagnosis or the degree of their needs. In a “limited and smaller number” of cases, the district says bus routing information, student intervention records and other assessments were stolen. The district maintains that the impact on students, parents and guardians was “limited” and the “most sensitive information” remains secure. As for staff, the district says what was potentially stolen varies by individual, but information contained in personnel records was put at risk. The Burnaby RCMP and the Office of the Information and Privacy Commissioner for B.C. have been notified. The district says it offered students registration with TransUnion’s Fraud Alert Database on Wednesday, which alerts creditors to potential fraud. “This does not mean that all students have a high risk associated with their information. Rather, this was offered in an abundance of caution and to support all families,” the statement reads. It asks members of the Burnaby schools community to remain vigilant and use caution in the event of any suspicious emails, texts or phone calls.
