Massive Data Breach Hits Winnipeg's School Division

A significant cyber breach has impacted a school division in south Winnipeg, revealing the details of almost 1 million files containing sensitive personal data.

The investigation into the leaked data concluded on November 26, with notifications dispatched to individuals affected by the breach on Wednesday.

Among the compromised data were backups of the student information system, payroll details for staff, records from 12 schools, and various administrative documents. The attack occurred last December when a hacker group sought to sell this data for over $1 million in bitcoin. Following the lack of buyers, the data was subsequently exposed on the dark web.

According to the notification, personal details of students registered in 12 of the 36 schools between 1999 and 2024 might have been compromised, including contact information, health details, and numbers from passports, health cards, and social insurance.

Staff members and teachers from 2001 to 2024 are also believed to have been affected, with their SINs, bank details, and disciplinary records potentially exposed. Moreover, individuals who submitted passport images, driver’s license numbers, or cheques to the division from 2005 to 2024 may also have their data compromised.

The division is collaborating with a security vendor to bolster its protective measures and implement 24/7 monitoring. Those identified in the investigation have been informed, and there are no anticipated further updates.