Burnaby School District

Summary

A Russia-linked ransomware group known as Qilin claims to have published stolen data from the Burnaby School District on the dark web, including medical records, learning assessments, payroll details, and personal information concerning staff and students. Screenshots of the leak site display folders labeled harassment investigations, discipline, payroll, and mental health and wellness, with the district confirming that personal information was copied and stolen while stating that most records remain secure. The group operates as a ransomware-as-a-service provider and has been associated with other high-profile intrusions, though the district has engaged an external expert to verify the nature and extent of the exposed information.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hackers breached computer systems belonging to the Burnaby School District on September 21. The perpetrators appear to have started posting information online almost immediately. On October 14, district superintendent Karim Hachlaf wrote to families confirming that files taken containing personal information were copied and stolen by the criminal parties responsible for the attack. Hachlaf's note stated that most of the information maintained by the district about students, parents and guardians remains secure. The note also noted that some bus touring information, student intervention records and other student assessments had been affected in a limited and smaller number of cases. In an email sent on Tuesday, the district warned parents that the threat actor claims to have published files and information from this incident on the dark web. The district said it has shared reliable information with staff and families as it becomes available. The district engaged an external expert to help confirm whether data from the Burnaby School District has in fact been posted on the dark web and, if so, the nature and extent of any affected information.

Qilin, a shadowy Russian ransomware group that operates as a Ransomware-as-a-Service provider, posted screenshots on the dark web from what appears to be a database stolen from the Burnaby School District. The group claims to offer downloads of information allegedly taken during a massive data breach that school officials have said included medical information, detailed learning assessments, and personal information about both staff and students. CBC News located the database shortly after the school district issued its warning to parents. The files appear on Qilin's dark web site in what is effectively a multi-page listing of sets of data stolen from various agencies, companies and individuals worldwide. According to the screenshots posted online, the files contain a terabyte worth of data and have allegedly been seen nearly 4,000 times since they were first posted publicly on October 15. Screenshots of the files include folders labelled "Harassment Investigations," "Discipline," "Payroll" and "Mental health and Wellness." CBC News has not viewed the contents of the folders. The screenshot samples contain school district letterhead and human resource categories attached to what appear to be bulky files of data. The September attack raised alarms with parents and students who contacted CBC News concerned that children's data may be in the hands of cybercriminals bent on exploiting deeply personal information for profit. One parent wrote to CBC News that their school has compromised their children's identity. One current Grade 12 student in the Burnaby Schools District wrote that they have been affected. Students and families stated they have received virtually no clear communication. The warning sparked widespread concern.

Qilin is believed to be based out of Russia and provides tools for hackers to commit ransomware attacks in exchange for a cut of extortion profits. The group has been tied to a series of crippling high-profile ransomware attacks, most notably a 2024 cyberattack on Britain's National Health Service that saw major London hospitals cancel operations and blood transfusions. Just last month, Japanese authorities handed over a Russian national accused of being involved with Qilin in connection with a European ransomware attack to German authorities. The Canadian Centre for Cyber Security describes Qilin's business model as one in which a core group of developers will sell or lease their ransomware variant to other threat actors, called affiliates, and support affiliates' deployment of their ransomware in exchange for upfront payment, subscription fees, a cut of profits, or all three. According to a threat profile prepared by the U.S. Department of Health and Human Services in 2024, Qilin has been operating since 2022, likely originating from Russia, and was observed recruiting affiliates on a hacking forum in 2023. Qilin has been observed targeting organizations in various countries and industries, including education, healthcare and critical services, with geographical regions targeted including Australia, Canada, the United Kingdom, and the United States. The group's targeting appears to be opportunistic rather than targeted. Victims are directed to communicate with the attackers via dark web portals or encrypted messaging services. Payments are demanded in cryptocurrencies. However, even after payment, there is no guarantee that victims will receive the decryption tools required to recover their data.

Sources

Sources available to members: 1 source.