Pembina Trails School Division accounting spreadsheets leaked online after cyberattack

Accounting spreadsheets from Pembina Trails School Division were leaked online after they were accessed during a cyberattack that hit the division in December, but it is still unclear what information was in those documents.

The spreadsheets are only a chunk of the data stolen from the south Winnipeg school division during a breach carried out by a hacker group known as Rhysida. 

The division confirmed in early April the group demanded a ransom to get the data back, but said it wasn't paid. 

The group then advertised the sale of personal information and photos of students, teachers and staff going back to 2011 on the dark web — a part of the internet that can't be accessed with a traditional web browser. 

When no one bought the data, the group uploaded it online.

After the incident, Pembina Trails engaged a group of experts to review the files that had been leaked. In an update on Thursday, the division said that review has so far identified three categories of data that were compromised.

There is still no evidence that a database including staff payroll information has been accessed, but a spokesperson for the division told CBC News accounting spreadsheets, which were saved in the division's network drive, were among the files posted online. 

The division's experts, combing through the data, have yet to determine what kind of content is in these documents. 

Educational videos, student assignments stolen

A large group of miscellaneous files that had been saved in the division's network storage and shared with students and staff at a dozen schools were also stolen in the attack and later posted online. 

That included educational videos, lesson plans and student assignments from several schools — Acadia, Bairdmore, Crane, Fort Richmond, Oakenwald, Pembina Trails Collegiate, Ralph Maybank, Shaftesbury, South Point, St. Avila, Vincent Massey and Viscount, the division said.

The review also confirmed that, as the division previously reported, databases that included personal information from students who attended the division between 2011 and 2024 were leaked to the web. 

The school division had previously said that health identification numbers, parents' or guardians' contact information, and the most recent photos of some students had been accessed during the cyberattack. 

Pembina Trails said it has been working with a third-party security vendor to enhance security monitoring of its technology systems. 

"Unfortunately, organizations across the public and private sectors are being repeatedly targeted by cybercriminals," the division said in its update. 

"Nonetheless, we are emerging stronger from this experience."