The Burnaby School District in Burnaby, British Columbia, has confirmed a ransomware attack after discovering unauthorized access to its systems on September 21, 2026. School District 41 says criminal actors copied and stole files that contain personal information about some students, parents, guardians, staff and former employees.
In a public incident notice updated in early November, the district said it contained the intrusion, brought in cybersecurity specialists, and notified authorities. Phone service across schools and district sites returned on September 28, and access to MyEducation, including the family portal, returned on October 1. The district says student learning continued without disruption while systems were restored.
The Qilin ransomware group has allegedly listed Burnaby School District on its data leak site and claimed responsibility for publishing stolen files. The district says it has received reports that the threat actor claims to have posted information from the incident on the dark web, believes some district files may have been included, and has engaged an external expert to verify those claims and the scope of any posted material.
What the district says was stolen
Burnaby Schools states that most sensitive information it holds about students, parents and guardians remains secure, and that the impact on those groups was limited. Categories of information that may have been affected include:
- General student, parent and guardian details for 2024 and 2026, such as names, contact information, Personal Education Numbers, dates of birth, grade, school and, where applicable, Ministry designation codes
- Registration packets for students who enrolled in 2024 or 2026, including residency documentation families submitted
- Kindergarten assessment notes and projections from 2021 through 2025
- Lists of students receiving specialized learning supports, sometimes with brief descriptions of needs or diagnoses
In a smaller set of cases, the district says bus routing information, student intervention records and other assessments were also affected. Files about some former employees were among those involved, and the district is contacting those people directly. A continuing review may identify more affected individuals as findings are confirmed.
Qilin leak claims remain under review
According to reports that monitor ransomware leak sites, Qilin allegedly listed the district and claimed roughly 1 TB of stolen data around mid-October 2026. Screenshots circulating with those claims reportedly show folder labels tied to payroll and other personnel records. BreachNews has not independently verified the authenticity or completeness of any leak-site material, and the district has not confirmed which specific files, if any, appear online.
Qilin is an established ransomware operation known for double-extortion attacks against public-sector and education targets. The group previously claimed a ransomware incident involving the City of Columbia, South Carolina. Education networks remain a frequent target for ransomware crews; recent school-sector coverage includes a 3AM affiliate intrusion at a UK school estate and a claim against Michigan State University by the BYOD ransomware gang.
Notifications, fraud alerts and authorities
The district reported the cyberattack to the Burnaby RCMP and to the Office of the Information and Privacy Commissioner for British Columbia. It has been notifying affected staff, students and families as the investigation identifies involved records, and it directs privacy questions to Privacy.Officer@burnabyschools.ca.
As a precaution, the district offered TransUnion Fraud Alert Database registration to staff after an October 1 notice and to students and families on October 14. The district says the offer does not mean every student faces a high risk; it is intended to help creditors take extra identity checks before extending credit. Staff notices said information in personnel records had been placed at risk, with details varying by person.
Burnaby Schools continues to urge families and staff to treat unexpected requests for personal information, unusual emails, texts or phone calls with caution, use unique passwords, enable multi-factor authentication where available, and report suspected fraud to the relevant institution and police. Full answers to common questions appear in the district’s cyber incident FAQ, with the latest operational summary on its incident page.
The investigation remains open. The district has not publicly attributed the intrusion to a named group beyond describing criminal actors behind a ransomware attack, while Qilin’s leak-site claim is still being checked by the district’s outside expert.
