Burnaby ransomware: from the September discovery to the claimed November leak
On September 21, 2026, the Burnaby School District (B.C.) discovered a Burnaby ransomware incident on its systems. Phones came back on September 28; MyEducation and the family portal on October 1. In early November, the Qilin group claimed to have leaked stolen files, and former employees received notice that their personnel records may have been exposed.
Timeline, common myths about ransomware in organizations, and a checklist for a Quebec or Canadian SMB or agency that holds personal data.
Burnaby ransomware: the chronoband
The district confirms an unauthorized party accessed its systems. Immediate containment, external specialists, notice to authorities.
Phone service is back at all schools and district sites.
Access to MyEducation, including the family portal, is restored. Student learning was not disrupted, per the district.
Staff are told personnel records were placed at risk. TransUnion is offered to staff.
As a precaution, TransUnion Fraud Alert registration is offered to students.
A letter (reported by CityNews) warns former employees and offers 24 months of credit monitoring / identity theft protection.
The district receives reports that the actor (Qilin, per CBC) claims to have published files. An external expert is checking the scope.
Per the district’s official page (updated November 3, 2026), stolen files may have included, for 2024 and 2026: names, contact details, Personal Education Number (PEN), date of birth, school/grade, sometimes a ministry designation; registration forms and residency documents; kindergarten assessment notes (2021–2025); lists of students receiving specialized learning support, sometimes with a diagnosis. Files about some former employees were among those affected.
Myths and facts about ransomware in organizations
❌ Myth 1
“We paid / we restored — we’re done.”
✅ Fact 1
The Burnaby ransomware case shows the other side: even after services return, copied files can resurface weeks later on the dark web.
❌ Myth 2
“We’re not a school or a hospital — nobody cares.”
✅ Fact 2
Actors chase usable personal records (identity, residency, diagnoses). An SMB, clinic, association or municipality holds the same kind of data.
❌ Myth 3
“Backups are enough.”
✅ Fact 3
Backups help you resume operations. They do not pull back a copy that already left, or remove the duty to notify and offer protection.
❌ Myth 4
“We’ll notify when we know everything.”
✅ Fact 4
Burnaby published early, then updated: phones, portal, nature of records, TransUnion offer, former staff. Progressive notice beats prolonged silence.
Checklist: lessons for Quebec and Canada
If you hold personal data (clients, students, patients, employees)
- ☐ Inventory: where do PII live (files, shares, backups, portals)? Who can reach them?
- ☐ Segmentation: student / client / HR files should not all be reachable from the same compromised workstation.
- ☐ Detection + response: automated 24/7 monitoring with on-call technician response shortens the window where an attacker quietly copies data.
- ☐ Notice plan: who contacts police, the privacy commissioner, affected people? Who drafts letters (current and former)?
- ☐ Protection offer: plan ahead how you would offer fraud alerts / credit monitoring, as Burnaby did via TransUnion.
- ☐ Drill: test a restore and a “files already out” simulation — they are not the same scenario.
- ☐ Internet-facing NAS / RDP: close classic entry doors; see also our article on C3RB3R ransomware on Synology NAS.
Ransomware is not only encryption: it is often file theft followed by public pressure. Our cybersecurity services cover prevention, detection and response planning.
How NeoTech can help
We map where your personal data lives, close unnecessary entry doors, and set up automated 24/7 monitoring with on-call technician response. For a full picture, see our cybersecurity services and the free cyber check.
Book your free cyber check
In 30 minutes, we look together at where your personal records live, which entry doors are open, and what it would take to detect and respond faster.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Burnaby Schools — Incident Impacting Operations (updated Nov. 3, 2026)
- CBC News — Qilin / Burnaby ransomware
- CityNews Vancouver — former staff notice, Nov. 5, 2026
Photo: Pixabay, Pexels (Pexels licence).