Burnaby School District ransomware: what families should know

The Burnaby School District in British Columbia says a ransomware attack discovered on September 21, 2026 ended with files containing personal information being copied and stolen. Some of it is about children, and some of it is sensitive. If your family is in the district, or you work there, here’s what the district has said and what’s worth doing.

What happened

The district’s incident page says an unauthorized party got into its systems and that, during the ransomware attack, “files containing personal information were copied and stolen by the criminal actors responsible.” Phones were restored on September 28 and the MyEducation family portal on October 1.

The district says most of the sensitive information it holds about students and families remains secure. The information that may have been affected includes:

• names and contact details of students, parents and guardians for 2024 and 2026, with the student’s Personal Education Number, birth date, grade, school and, where applicable, Ministry designation
• registration forms and residency documents for students who enrolled in 2024 or 2026, which can include citizenship or permanent resident papers, visas, ID, leases or utility bills
• kindergarten assessment notes and projections from 2021 to 2025
• lists of students receiving specialized learning support, with a brief description of the support and, in some cases, a diagnosis

In a smaller number of cases, bus routing information, student intervention records and other assessments were affected. Staff were told on October 1 that information in personnel records had been placed at risk.

The district has reported the incident to the Burnaby RCMP and the Office of the Information and Privacy Commissioner for B.C. On October 14 it offered students registration with TransUnion’s fraud alert database. Staff were offered TransUnion’s services after their notice on October 1.

What this means for you

Most children have no credit history, which makes a clean file attractive to someone trying to open credit under a new identity, and it can go unnoticed for years. The residency documents are the more serious part for families who enrolled in 2024 or 2026: a copy of ID or a lease is exactly what fraudsters use to look legitimate.

The learning-support details can’t be undone with a password reset. If you’re worried about how that information could be used, you can ask the district what it held about your child.

What you can do

1. Register for the TransUnion fraud alert. The district offered it to students on October 14, and to staff earlier. It asks lenders to verify identity before extending credit in that name.
2. If you sent ID for registration, treat it as exposed. Watch for accounts or applications you don’t recognize in a parent’s name, and see our guide to what to do after a data breach in Canada.
3. Be careful with messages that mention your child’s school. A message that knows your child’s name, grade and school feels trustworthy. The district says to stay cautious with unexpected emails, texts or calls asking for personal information. See how scammers use leaked data.
4. Ask for what was held about your child. Under B.C.’s public-sector privacy law you can request your child’s records from the district. If you’re unhappy with the answer, the Information and Privacy Commissioner for B.C. takes complaints.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• Burnaby School District, Incident Impacting Operations, updated October 14, 2026
• The Canadian Press via The Globe and Mail, Cyberattack may have leaked student and parent information, Burnaby school district says, October 15, 2026