'Appalling' Pembina Trails hack could cause a lot of damage, privacy expert says

Arturo Chang · CBC News

· Posted: Apr 14, 2025 8:29 PM EDT | Last Updated: 10 minutes ago

A privateness adept says she's not seen a breach elsewhere successful Canada that matches the standard of the Pembina Trails School Division hack.

Almost a cardinal files amounting to astir 4.5 terabytes of information person been released connected the acheronian web aft the radical down a December attack targeting the Winnipeg schoolhouse part couldn't find a purchaser for the information.

Ann Cavoukian, enforcement manager of Global Privacy & Security by Design and erstwhile Ontario privateness commissioner, said she's alert of attacks of a akin magnitude elsewhere successful the world, including Europe and Japan, but not successful Canada.

"It's appalling and tin origin truthful overmuch damage," she said successful an interrogation with the CBC's Up to Speed Monday. 

"Unauthorized 3rd parties tin usage your idiosyncratic accusation to contiguous you successful a antithetic light, to [get] entree to things that you would similar not to have, and besides to springiness unauthorized 3rd parties entree to your idiosyncratic information. They tin spell bash immoderate the heck they privation with it."

The information breach from December was carried retired by ransomware hacking radical Rhysida. It unopen down the division's networks for weeks, with everything from computers to printers, to clocks impacted by the attack.

The schoolhouse said the accusation stolen by the hackers goes backmost to 2011.

Data should've been amended protected: Student

The information that was perchance exposed includes names, dates of birth, confidential concern data, idiosyncratic wellness accusation and email addresses arsenic good arsenic payroll information, recognition paper statements and adjacent photos of valid passports.

Sabastian Kelly, who's successful Grade 10, said that portion students had idiosyncratic information leaked, he's mostly disquieted astir teachers and different schoolhouse unit who've had much delicate accusation similar societal security numbers exposed successful the attack.

"We can't bash excessively overmuch to not person it retired determination due to the fact that it's already been released," Kelly said. 

"Obviously I'm not an IT professional," helium said. "But what I tin accidental is that this information … should person been protected a small spot better."

LISTEN | Privacy adept weighs successful connected Pembina Trails cyberattack:

VenariX, an American steadfast that investigates cybersecurity incidents, said it recovered the leaked information from 31 different schoolhouse divisions connected the acheronian web.

Cavoukian said the Pembina Trails attack, portion appalling, is not surprising. 

"When governments, schools, schoolhouse boards person personally identifiable information … this should beryllium precise powerfully protected," she said.

"It should beryllium encrypted. There should beryllium walls enactment astir it truthful that unauthorized 3rd parties can't summation entree to it."