A shadowy Russian ransomware group has posted screenshots on the dark web from what appears to be a database stolen from the Burnaby School District.
The group — which calls itself Qilin — claims to offer downloads of information allegedly taken during a massive data breach school officials have said included medical information, detailed learning assessments, and personal information about both staff and students.
Qilin is renowned as a Ransomware-as-a-Service (RaaS) provider that offers tools and infrastructure to hackers anywhere in the world in exchange for a percentage of proceeds demanded from victims.
While CBC News has not downloaded the contents of the files themselves, the screenshot samples posted on the Qilin website contain school district letterhead and human resource categories attached to what appear to be bulky files of data.
‘Harassment Investigations’ and ‘Discipline’
The September attack on the Burnaby School District raised alarms with parents and students who contacted CBC News concerned that children’s data may be in the hands of cybercriminals bent on exploiting deeply personal information for profit.
Working with CBC’s visual investigations team, CBC News located the database shortly after the school district warned parents in an email Tuesday that “the threat actor claims to have published files and information from this incident on the dark web.”
Hackers breached computer systems belonging to the Burnaby School District in September. The information they stole has been posted to the dark web. (CBC News)
The files appear on Qilin’s dark web site in what is effectively a multi-page listing of sets of data stolen from various agencies, companies and individuals worldwide.
According to the screenshots posted online, the files contain a terabyte worth of data and have allegedly been seen nearly 4,000 times since they were first posted publicly on Oct. 15.
Screenshots of the files include folders labelled “Harassment Investigations,” “Discipline,” “Payroll” and “Mental health and Wellness.”
CBC News has not viewed the contents of the folders.
In a statement to CBC News, the Burnaby School District said it has shared “reliable information with staff and families as it becomes available.”
“We have engaged an external expert to help confirm whether data from the Burnaby School District has in fact been posted on the dark web and, if so, the nature and extent of any affected information,” the statement said.
Widespread concern
According to the school district, hackers gained access to the district’s systems on Sept. 21. The perpetrators appear to have started posting information online almost immediately.
CBC News received numerous emails about the incident after district superintendent Karim Hachlaf wrote to families on Oct. 14 confirming that “files taken containing personal information were copied and stolen by the criminal parties responsible for the attack.”
CBC’s visual investigations team took this screenshot of the dark web site where data stolen from the Burnaby School District in September appears to have been posted. The site belongs to Qilin, a Russia-linked group that provides hackers with online tools in exchange for a cut of ransomware profits. (CBC News)
Hachlaf’s note claimed “most of the information maintained by the district about students, parents and guardians remains secure” but noted that “some bus touring information, student intervention records and other student assessments” had been affected “in a limited and smaller number of cases.”
The warning sparked widespread concern.
“Help, our school has compromised our children’s identity,” one parent wrote to CBC News in an email that contained a copy of Hachlaf’s note.
“I am a current Grade 12 student in the Burnaby Schools District who’s been affected,” wrote one student.
“Currently students and families have received virtually no clear communication.”
Crippling attacks on institutions
In recent years, Qilin has been tied to a series of crippling high-profile ransomware attacks — most notably a 2024 cyberattack on Britain’s National Health Service that saw major London hospitals cancel operations and blood transfusions.
Just last month, Japanese authorities handed over a Russian national accused of being involved with Qilin in connection with a European ransomware attack to German authorities.
The files contain medical information, detailed learning assessments and personal information about both staff and students. (Ben Nelms/CBC)
Ransomware attacks on health-care services and school districts have risen around North America, with schools in the U.S and Canada being targeted.
More than 60 million students and nine million teachers in both countries were impacted by a data breach of educational software provider PowerSchool.
The Associated Press found files describing sexual assaults, private hospitalizations and parental abuse among troves of data dumped online by a ransomware group that demanded $1 million in exchange for 300,000 files stolen from a school district in Minneapolis.
The Canadian Centre for Cyber Security describes Qilin’s business model as one in which “a core group of developers will sell or lease their ransomware variant to other threat actors, called affiliates; the core developers will support affiliates’ deployment of their ransomware in exchange for upfront payment, subscription fees, a cut of profits, or all three.”
According to a threat profile prepared by the U.S. Department of Health and Human Services in 2024, Qilin has been operating since 2022, likely originating from Russia. The threat profile claims Qilin was observed “recruiting affiliates on a hacking forum” in 2023.
“Qilin is known to target organizations in various countries and industries, including education, healthcare and critical services, with geographical regions targeted including Australia, Canada, the United Kingdom, and the United States, among others. The group’s targeting appears to be opportunistic rather than targeted,” the threat profile reads.
“Victims are directed to communicate with the attackers via dark web portals or encrypted messaging services, ensuring the attackers’ anonymity and complicating law enforcement efforts to track interactions. Payments are demanded in cryptocurrencies … However, even after payment, there is no guarantee that victims will receive the decryption tools required to recover their data.”
Seeking ‘information they can use’
Chester Wisniewski, chief information security officer and director of Vancouver-based computer security firm Sophos, told CBC News that attacks on schools are particularly common at the start of the school year in September and October.
“They’re vulnerable because they’re serving a large portion of the public, and them being offline or unable to open the schools provides an enormous amount of public pressure to do something,” Wisniewski said.
“Usually they’re after payroll information, they’re after medical and personal information they can use. They’re trying to upset the staff and the parents of the students in the case of a school, to get them to apply pressure on the school to pay an extortion demand.”
To that end, Wisniewski said the thieves “don’t care about your kids’ grades, but they might care about their disabilities, or their learning problems, or their behaviour problems, or sensitive information about the finances of the staff members that work in the school.”
Wisniewski said the Burnaby School District is working with another firm to strengthen security. He added that the public should refrain from blaming the victim.
Despite the fears of parents, Wisniewski said past attacks on other school districts have rarely resulted in individual harm.
“The odds of something happening to your child’s information despite it being published on the dark web where criminals hang out — it’s a pretty low risk,” he said.
“But it’s certainly something to be concerned about and take protective actions.”
