Burnaby schools warn stolen data may be on dark web

The Burnaby School District has told parents that the group behind a September cyberattack claims to have published stolen files on the dark web, and the district says it has hired an outside expert to find out whether that is true.

The district warned parents in an email on Tuesday that “the threat actor claims to have published files and information from this incident on the dark web,” CBC News reported. CBC said it then found a listing for the data on a site belonging to Qilin, a ransomware group that its reporting links to Russia. CBC said it did not download the files, but that sample screenshots showed district letterhead and human resources categories.

Canada News Media has not viewed the listing or the files, and neither the claim nor the contents have been independently confirmed by us.

What the district has said

According to the district, the attackers got into its systems on Sept. 21. Superintendent Karim Hachlaf wrote to families on Oct. 14 that files containing personal information had been copied and stolen, CBC reported. He said most information about students, parents and guardians remained secure, but that some bus information, student intervention records and other student assessments were affected in a limited number of cases.

School officials have said the breach involved medical information, detailed learning assessments and personal information about staff and students, according to CBC. Some students and families told the broadcaster they had received little clear information.

In a statement to CBC, the district said it has shared reliable information with staff and families as it becomes available. It said the outside expert will help confirm whether its data has been posted and, if so, the nature and extent of what was affected.

The district is offering credit monitoring to thousands of students, families and staff, Global News reported.

Who Qilin is

Qilin rents ransomware tools to other criminals in exchange for a share of the proceeds, according to the Canadian Centre for Cyber Security’s description cited by CBC. A 2024 U.S. Department of Health and Human Services profile, also cited by CBC, says the group has operated since 2022 and likely originated in Russia, and that it has targeted organizations in education, health care and other sectors, including in Canada.

What families can do

Families should read the district’s notices directly and use the credit monitoring offer if it applies to them. Anyone who gets an unexpected message mentioning a student’s records, a school or a payment should be wary of it, and should check with the school or district through a known phone number or address rather than by replying or clicking a link.

The story is developing. We will update it when the district says what its review found.