Canadian Mennonite University breach exposed SINs on a decade of tax slips

Canadian Mennonite University in Winnipeg says an attacker got into its systems in September and accessed tax slips it had issued to staff and students, including social insurance numbers. Letters went out in early October. If you worked or studied at CMU in the last decade, here’s what is known and what to do.

What happened

CMU first noticed on September 18, 2026 that its system had been compromised, CBC News reported. Working with cybersecurity experts through its insurer, the university found that two kinds of tax forms had been accessed:

• T4 slips, which report employment income, issued from 2015 to 2025
• T2202 slips, which report tuition amounts for students, over a shorter period

The slips include names, mailing addresses and social insurance numbers. Just under 4,000 current and former students, staff and faculty were first thought to be affected. A university spokesperson told CBC that further investigation found about 20 per cent of those weren’t compromised after all, but they are still being offered the same help.

CMU posted a notice on its website and mailed letters. It is offering two years of free credit monitoring and says it has no evidence the data has been misused.

What this means for you

A social insurance number is one of the few things in Canada that can’t easily be replaced. Combined with your name and mailing address, it’s the core of what someone needs to try opening credit, filing a tax return, or claiming benefits in your name. That risk doesn’t expire after two years, so the monitoring is a start, not the whole answer.

What you can do

1. Enrol in the credit monitoring. It’s free, and it will tell you if someone applies for credit in your name. The enrolment details are in your letter.
2. Add a fraud alert with both credit bureaus. Equifax Canada and TransUnion Canada both let you put an alert on your file so lenders take extra steps to confirm it’s really you. Our guide to what to do after a data breach in Canada has the steps.
3. Watch your CRA account. Sign in to CRA My Account and check your address, direct deposit details and any returns filed. A change you didn’t make is the earliest sign of tax fraud.
4. Contact Service Canada if your SIN is misused. If you see signs someone is using your SIN, Service Canada is the place to report it, along with your local police.
5. Ignore “CMU” or “CRA” messages asking for your SIN. The university already has what it needs. A call or email asking you to confirm your SIN because of this breach is a scam.

How Frame helps

Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.

Sources

• CBC News, Canadian Mennonite University warns of data breach in cyberattack, October 8, 2026