Highland Shores Children’s Aid says files with SINs, medical and court records were taken

Highland Shores Children’s Aid Society, the child welfare agency for Hastings, Northumberland and Prince Edward counties in eastern Ontario, has posted a public notice saying an unauthorized person got into part of its network, took files containing personal information and encrypted some systems. The agency found the attack on August 25, 2026. Its investigation found the intruder had been inside since July 6.

The notice, dated November 4, covers some of the most sensitive records an organization can hold: information about children and families who received child welfare services, foster and adoptive caregivers, and court records.

Who is affected

Highland Shores says the notice applies to you if any of these is true:

• You received services from Highland Shores or the agencies it replaced: the Children’s Aid Society of the County of Prince Edward, Hastings Children’s Aid Society or the Children’s Aid Society of the County of Northumberland, at any time.
• You received services from or took part in its Therapeutic Family Care program between 1995 and 2026.
• You were a foster, kinship, adoption or customary care provider before 2019.
• You were a board member before 2019.

It hasn’t said how many people that is.

What was taken

Depending on your relationship with the agency, Highland Shores says the files may have included:

• People who received services (including Therapeutic Family Care): name, contact information, date of birth, financial information, Social Insurance Number, government ID, information about services received, child welfare record checks and results, medical information and assessments, and court records.
• Foster, kinship, adoption and customary care providers before 2019: name, contact information, date of birth, medical and insurance information, financial information, SIN, police record check information and child welfare record checks.
• Board members before 2019: name, contact information and date of birth.

The agency says not every item was involved for every person, that it has seen no evidence of identity theft or fraud so far, and that it has “taken all possible measures” to stop the data being published or misused. It says it will keep monitoring the internet, including the dark web, and update the notice if it learns of misuse. Its notice doesn’t mention credit monitoring.

A local charity is affected too

Highland Shores also provides IT services to The Children’s Foundation, a charity that funds programs for children and youth in the same three counties. In its own notice dated November 5, the foundation says its information was stored in the affected environment, so details about its volunteers, donors, current and former board members and program applicants may have been taken. For them, the information listed is limited to names, mailing addresses, phone numbers and email addresses. Quinte News reports that no credit card or banking information was involved for the foundation.

What the agency has said and done

Highland Shores says it contained the attack, brought in outside cybersecurity experts, strengthened its security and reported the incident to regulators and the police. It hasn’t named the attacker or said whether a ransom was demanded. Both organizations say no action is required right now, and both say they will never ask for sensitive personal information by unsolicited email or text.

What you can do

1. Expect scams that use what was taken. A caller or email that knows your file, your child’s name or your court case can sound very convincing. Highland Shores won’t ask for sensitive details by email or text. If you’re unsure, call the agency at the number on its website.
2. Protect your SIN. If your Social Insurance Number may be involved, watch for signs of misuse, like a tax slip from an employer you don’t know. Service Canada explains what to do if your SIN is misused.
3. Consider a fraud alert and check your credit report with Equifax Canada and TransUnion Canada, especially if the notice describes you as a service recipient or caregiver.
4. Ask questions or complain. You can contact Highland Shores at 1-800-267-0570 (option 5) or privacy@highlandshorescas.com, and you have the right to complain to the Information and Privacy Commissioner of Ontario.
5. Read what to do after a data breach in Canada for a short checklist.

How Frame helps

If this breach is added to a breach catalog, add it to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• York University says personal details were stolen from departmental web forms going back to 2007: another Ontario breach this month, also reported to the province’s privacy commissioner.
• Burnaby School District ransomware: what families should know: a Canadian ransomware attack involving information about children and families.

Sources

• Highland Shores Children’s Aid Society, November 4, 2026: Cybersecurity Incident at Highland Shores Children’s Aid, November 4, 2026
• The Children’s Foundation, Cybersecurity Incident Notification, November 5, 2026
• Quinte News, Data breach at The Children’s Foundation, November 10, 2026