Pembina Trails conducts deep-dive into hacked files

Hey there, time traveller!
This article was published 01/05/2025 (217 days ago), so information in it may no longer be current.

Cybersecurity experts are scanning a new dataset of leaked files from 12 schools in south Winnipeg for passport scans and social insurance numbers.

The Pembina Trails School Division updated staff and student families Thursday about its ongoing probe into a cybersecurity attack that has paralyzed the organization since it was flagged Dec. 2.

Superintendent Shelley Amos said in her latest memo that academic plans and projects from a dozen communities were found on the dark web.

“These miscellaneous files appear to contain mainly educational videos, lesson plans and student assignments accounting for the large volume of digital content,” the chief executive officer wrote.

Amos said a deep-dive into these materials, which were saved in network storage, is underway to pinpoint sensitive data, such as student or staff SINs. Affected individuals will be contacted if need be, she said.

The elementary campuses in question include Ralph Maybank, Acadia, Bairdmore, Oakenwald, Crane, St. Avila, Viscount Alexander and South Pointe. Every grade 9-12 building — Pembina Trails, Shaftesbury, Fort Richmond and Vincent Massey — except for Oak Park is affected by the latest development.

Broader backups of the division student information system database between 2011 and 2024 and staff payroll information were previously found to be compromised. The former includes student names, birth dates, addresses, photos, health information and family contact details.

“Despite the best efforts of the division, worry, stress and workload are compounding each and every week — and with every new revelation,” said Lise Legal, president of the local teachers’ association representing 1,200 full-time equivalent teachers.

Legal added: “No one has a crystal ball to see when this will end, but members need relief.”

Pembina Trails hired a third-party security vendor in December to bolster its information technology systems and provide 24-7 security monitoring. Administration has offered to pay for 36 months of credit monitoring for current and former staff members.

Rhysida, a hacker group, has claimed responsibility for the attack. It tried to sell the stolen data for 15 bitcoins — about $2 million — after the division refused its ransom demand.

The cleanup had cost Pembina Trails upwards of a half a million dollars — $151,000 on credit monitoring, $284,000 on information technology services and $83,000 on legal advice — by the end of January, per a breakdown obtained by the Free Press.

The roundup, which was prepared in response to a freedom of information request, shows the board office also paid $19,000 for public relations expertise during the first two months of the crisis.

“Other than approximately $50,000 of costs related to credit monitoring, (these) costs are being claimed for reimbursement under the division’s cyber-insurance policy,” the document states.

maggie.macintosh@freepress.mb.ca