Payroll data breach: 10 years of T4 slips stolen, the before/after for your SMB
On October 8, 2026, CBC reported that a cyberattack on Canadian Mennonite University (CMU) in Winnipeg exposed employee T4 tax slips going back to 2015 and student T2202 slips since 2019, with names, addresses and social insurance numbers. A small organization (775 students, about 90 instructors) and ten years of sensitive data at once. This payroll data breach raises a simple question for any SMB: why keep all of that so long, and so accessible?
What happened, in three dates
September 18, 2026
The university notices its systems have been compromised.
Late September
With experts brought in through its insurer, it confirms access to T4 and T2202 slips: names, addresses, SINs, earnings, birth dates.
Early October
Notice posted on its website, letters sent to affected people, two years of credit monitoring offered.
One positive takeaway: the university notified people in under three weeks and offered credit monitoring. That’s the kind of response expected from a Quebec business under Law 25 too.
Before / after: your payroll data
The real problem isn’t just the intrusion, it’s how much data there was to steal. Here’s the same situation in an SMB, before and after a bit of cleanup.
| ❌ Before | ✅ After |
|---|---|
| T4 slips from 2015 to today, all in the same shared folder | Only the years required by law; older ones securely destroyed |
| Social insurance numbers (SINs) visible in PDFs open to the whole team | Access limited to payroll, encrypted folder, mandatory multi-factor authentication |
| Former employees and interns never removed from lists | Retention register: who, what, how long, who destroys it |
| No plan if a breach happens | Law 25 procedure ready: assess the risk, notify Quebec’s privacy commission (CAI) and affected people |
How long should you keep T4 slips?
As a general rule, the Canada Revenue Agency asks you to keep records for six years after the end of the tax year they relate to; check with your accountant for your situation. Beyond that, every old SIN you keep is risk with no benefit. Quebec’s Law 25 also requires destroying or anonymizing personal information once its purpose is fulfilled.
Three simple steps for Monday
- Search your shares (SharePoint, OneDrive, file server) for “T4”, “payroll” and “RL-1” folders and check who has access.
- Turn on multi-factor authentication for every account that touches payroll.
- Set up encrypted backups and automated 24/7 monitoring with on-call technician response.
To go further, read our article on a vendor data breach (Maximus, PEI) and the 5 signs an SMB is an easy target.
Book your free cyber check
Where is your payroll data, and who can see it? Our free cyber check reviews your access, backups and protections, with recommendations tailored to Law 25.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CBC News — Canadian Mennonite University warns of data breach in cyberattack (Oct 8, 2026)
- Canadian Underwriter / La Presse Canadienne — Hackers access decade worth of personal data at CMU (Oct 9, 2026)
Photo: Christina Morillo, Pexels (Pexels licence).