ManitobaA school division in south Winnipeg says it’s wrapped up an investigation into a cyberattack last year that led to nearly 1 million files, and the personal data of students, staff and families, being leaked into the dark web.Students in 12 schools, teachers across division likely impacted, superintendent says in noticeArturo Chang · CBC News · Posted: Dec 03, 2025 4:11 PM EST | Last Updated: 2 hours agoListen to this articleEstimated 2 minutesThe audio version of this article is generated by text-to-speech, a technology based on artificial intelligence.Pembina Trails School Division said Wednesday it has concluded its review into a December 2024 data breach. (Karen Pauls/CBC)A school division in south Winnipeg says it’s wrapped up an investigation into a cyberattack last year that led to nearly 1 million files, and the personal data of students, staff and families, being leaked into the dark web.Pembina Trails superintendent Shelley Amos said in an statement the review of the leaked data wrapped up on Nov. 26, and final notices were sent to those affected on Wednesday.”We identified backups of our student information system database, excerpts from our staff payroll database, student and staff storage files from 12 schools, and division administrative documents among files taken,” she said.A hacker group attacked the school last December and then tried to sell the information for over $1 million in bitcoin. The group released the information on the dark web after no buyer came through.The latest update, posted Wednesday, included information about the groups of individuals affected and specific types of personal information likely involved.The notice said the hackers potentially obtained personal information of students who were enrolled in 12 of the division’s 36 schools between 1999 and 2024, including their contact information, personal heath information and passport, health card and social insurance numbers.They also likely obtained personal information of teachers and staff in all schools from 2001 and 2024, including SINs, bank account numbers and disciplinary information.Anyone who wrote cheques to the division between 2021 and 2024, or shared with them passport scans or driver’s licence numbers between 2005 and 2024 may also have likely affected by the leak, the Wednesday notice said.The division said it’s working with a vendor to improve security measures and provide 24/7 monitoring. Victims identified as part of a review of the leaked files will be notified, it said.The division does not expect more updates on the data breach, it said. Amos was not available for an interview. ABOUT THE AUTHORArturo Chang is a reporter with CBC Manitoba. Before that, he worked for CBC P.E.I. and BNN Bloomberg. You can reach him at arturo.chang@cbc.ca.
Pembina Trails releases more information about cyberattack after probe concludes
