1 (888) 897-3611 Book a call

Breach report · Education

Burnaby School District says ransomware attack may have exposed student and parent information

Burnaby School District says its Sept. 21, 2026 ransomware attack may have exposed student and parent details. What was taken and what to do now.

By happier IT 5 min read

The Burnaby School District in B.C. says hackers may have copied student, parent and guardian information in a September 21, 2026 ransomware attack, The Canadian Press reported on October 15. The district is offering families a TransUnion fraud alert service. Burnaby families should sign up and treat unexpected messages that mention their child or school with care.

What happened

On Monday, September 21, 2026, a cyberattack disrupted the Burnaby School District’s systems. CBC News reported on September 25 that superintendent Karim Hachlaf said the incident affected “some of our systems and operations, including internal network services and phone lines,” and that phones, Wi-Fi and printers were still out four days later. On September 29, CTV News reported that experts were still investigating and it was not yet known whether personal information had been stolen.

On October 15, The Canadian Press reported that the district’s online notice now describes the incident as a ransomware attack (malicious software that locks systems, often combined with theft of data) that affected school websites and portals as well as internal networks and phone lines. According to that notice, the attackers copied and took files that may have included:

  • names and contact details for parents, guardians and students
  • birthdates, grades and school names
  • registration forms
  • kindergarten assessment notes
  • detailed lists of students on specialized learning plans

The district says it has involved the Royal Canadian Mounted Police (RCMP) and B.C.’s privacy commissioner, and is reviewing the security of its systems.

Not yet known: how many people’s records were in the files taken, who carried out the attack, and whether a ransom was demanded. The district says the files “may” have held this information, so their exact contents are still being confirmed.

Who is affected

Potentially, students, families and staff of the Burnaby School District. CBC reported that, according to the B.C. government, the district has more than 29,600 students in 2025–26 across 41 elementary and eight secondary schools. That figure is the size of the district, not the number of people whose information was taken, which has not been reported.

What to do now

If you’re a Burnaby Schools family or staff member

  1. Register for the fraud alert service. The district has offered staff, students and families registration with TransUnion’s fraud alert service. Use the instructions in the district’s own notice.
  2. Be wary of messages that sound like the school. Details such as a child’s name, school, grade or learning plan can make a scam message feel genuine. If a call, text or email asks you to click a link, pay a fee or confirm personal details, stop and check.
  3. Verify through a channel you already trust. Call the school using a number you already have, or go to the district’s website by typing the address yourself.
  4. Never share passwords, banking details or a social insurance number in reply to an unexpected message, however official it looks.
  5. Talk to older children about messages that seem to come from their school, teachers or classmates’ parents.

If you run an organization

  1. Know your reporting obligations before you need them. Work out which privacy law applies to you and who makes the call on notifying people.
  2. Plan for losing your phones and email at the same time. This attack took out phone lines as well as networks. Keep an out-of-band contact list and a way to reach staff and clients.
  3. Keep backups you can actually restore from, with at least one copy that ransomware can’t reach, and test a restore.
  4. Hold less sensitive data, for less time. Files like assessment notes and registration forms carry the most risk if copied. Know where they live and who can open them.
  5. Turn on multi-factor authentication for email and remote access, and patch internet-facing systems promptly.

What this means for organizations in BC and Alberta

B.C. school districts are public bodies under the Freedom of Information and Protection of Privacy Act (FIPPA). Since February 1, 2023, section 36.3 has required a public body to notify affected individuals and the Office of the Information and Privacy Commissioner (OIPC) “without unreasonable delay” when a privacy breach could reasonably be expected to result in significant harm.

Private-sector rules differ. In Alberta, section 34.1 of the Personal Information Protection Act (PIPA) requires an organization to notify Alberta’s Information and Privacy Commissioner without unreasonable delay when there is a real risk of significant harm, and the commissioner can require the organization to notify the people affected. Organizations covered by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) must report breaches that create a real risk of significant harm to the Privacy Commissioner of Canada, notify affected individuals as soon as feasible, and keep records of every breach for two years.

If you hold information about children or vulnerable people, as schools, clinics and not-for-profits do, it’s worth having a breach-response plan written down now. More on how we support organizations in British Columbia.

How happier IT helps

We help organizations prepare calmly for incidents like this one: backups that restore, managed security that watches for trouble, and a clear plan for who does what on the day. If you’d like to know where you stand, start with a free IT assessment.

Sources

Common questions

What information may have been taken in the Burnaby School District cyberattack?
According to the district's notice, as reported by The Canadian Press, the files may have included names and contact details for students, parents and guardians, birthdates, grades and school names. They may also have included registration forms, kindergarten assessment notes and lists of students on specialized learning plans.
What should Burnaby families do now?
Register for the TransUnion fraud alert service the district is offering, and treat unexpected calls, texts or emails that mention your child or their school with care. Check anything that seems off by contacting the school at a number or website you already know, not one given in the message.
Do B.C. school districts have to tell people about a privacy breach?
Yes. Under section 36.3 of B.C.'s Freedom of Information and Protection of Privacy Act, a public body must notify affected individuals and the Information and Privacy Commissioner without unreasonable delay when a breach could reasonably be expected to result in significant harm. The Burnaby district says it has involved the commissioner.

More from the feed

Other incidents we've written up.

Want to know what this would look like for you?

A 30-minute call. No slides, no audit fee, no obligation. We ask what is breaking and tell you honestly whether we are the right fit.

Book a 30-minute call Get a free IT assessment

Or call 1 (888) 897-3611