The Burnaby School District is actively investigating a cyber incident that came to our attention on Monday September 21. District staff are working diligently to complete the investigation and restore remaining affected operations as soon as possible. Â
We understand that this news has been concerning. Protecting the personal information of the Burnaby Schools community is extremely important to us, and we sincerely regret that this incident has occurred.
What Has Occurred
Our investigation confirmed that an unauthorized party had gained access to the Burnaby School District’s systems.
Upon discovering the cybersecurity incident on September 21, 2026, we immediately took steps to contain it, engaged cybersecurity specialists to assist with our investigation and response efforts, and notified the appropriate authorities.
During this ransomware attack, an unauthorized third party gained access to certain files through District systems. While we acted quickly to respond to and contain the incident, some information and records were placed at risk. Although we are still in the process of completing our investigation, we confirmed that files containing personal information were copied and stolen by the criminal actors responsible for the attack. Due to this incident, some staff and student information was placed at risk. Files containing information about some former employees were among those that were affected. The District is contacting former staff directly.
We have recently received reports that the threat actor claims to have published files and information from this incident on the dark web. We have reason to believe that some files taken from the school district may have been included. We have engaged an external expert to help confirm whether this is the case and, if so, the nature and extent of any affected information.
Affected Information
The Burnaby School District recognizes that personal information relating to children and youth requires particular care. Fortunately, the impact on students, parents, and guardians was limited and most of the sensitive information maintained by the District about students, parents, and guardians remains secure.
Affected information may have included:
- General information about students, parents, or guardians for 2024 and 2026, such as the parent’s, guardian’s, and student’s names, contact information, the student’s Personal Education Number, date of birth, the grade, school, and, if applicable, Ministry designation (code and brief description);
- Student registration information for students who enrolled in either 2024 or 2026, which would include completed registration forms and supporting documentation provided to establish residency. For example, in order to establish residency, families may submit documentation for citizenship, permanent resident documents, visas, or confirmation of residency through submission of identification, leases, or utility bills;
- Kindergarten assessment notes and projections for the period of 2021-2025, which includes information about student readiness for kindergarten and notes about the student’s needs and complexities; and
- Lists of students receiving specialized learning assistance or supports, together with a brief description of the support, (in some cases) diagnosis and/or nature and degree of student needs and complexities.
In a limited and smaller number of cases the following information has been affected: some bus routing information, student intervention records and other student assessments.
Our Response
The Burnaby School District has reported this matter to the Burnaby RCMP and to the Office of the Information and Privacy Commissioner for BC. We are also continuing to investigate and to evaluate and improve our system security wherever possible to avoid any further incidents.
We have taken and will continue to take steps to keep affected individuals informed about this incident, and ways that they can protect themselves and their privacy.
This incident initially impacted some of our systems and operations, including internal network services and phone lines. Phone service was restored at all schools and across District sites on September 28 and access to MyEducation, including the family portal, was restored on October 1. Throughout, staff have worked hard across Burnaby Schools to ensure there has been no disruption to student learning.
Supporting Students, Families, and Staff
As an added precaution, on October 14 we offered students registration with TransUnion’s Fraud Alert Database. This does not mean that all students have a high risk associated with their information. Rather, this was offered in an abundance of caution and to support all families. Upon registration, the service will alert participating creditors to potential fraud involving registered students so that they can take additional steps to verify the applicant’s identity before extending credit.
TransUnion’s services were offered to all staff, following notice provided to them on October 1. Staff were informed that, while specific information potentially involved varies by individual, information contained in personnel records had been placed at risk. Where former staff have been impacted, in their notification, the District has also offered them TransUnion’s services.
Out of an abundance of caution, and as a matter of best practices, the District continues to encourage the Burnaby Schools community to remain vigilant and exercise caution in the event of any suspicious communications, including requests for personal information, unexpected emails, text messages, or phone calls.
Our Commitment
Direct communications are being regularly shared with families, staff, and District partners.
We understand that incidents of this nature are concerning and we remain committed to keeping the Burnaby Schools community updated throughout this process, as the investigation proceeds and additional information becomes available.
We remain appreciative for the understanding and patience shown across the District throughout this incident.
Additional Information
Answers to commonly asked questions can be found in the following document:
Frequently Asked Questions – Burnaby Schools Cyber Incident
Updated November 3 and Originally Posted September 23, 2026
