Overview

On September 21, 2026, the Qilin ransomware group broke into the Burnaby School District (SD41) network and copied 1.01 TB of data. That total covered 144,510 files in 39,992 folders: 1,034.2 GB of unencrypted SQL database backups and 93.5 GB from the Human Resources shared drive. After ransom talks failed, Qilin published the files on the dark web on October 26, 2026.

Independent documentation site, not affiliated with Burnaby School District. No leaked files or personal data are hosted on this site. Check Are you in the leak? to see if your records were included.

The "DO NOT USE" staff folder

Over 58% of all folders in the breach came from a single directory on the HR shared drive. Between 2018 and 2021, HR paid an outside scanning company to digitize paper employee binders and uploaded them to the district's eDocs system. When the upload finished, staff added "DO NOT USE" to the old folder name. They never deleted it. All 23,272 employee folders and 42,622 files sat on the shared drive for the next five to seven years.

Inside were 6,318 complete personnel binders and 6,004 Social Insurance Number sheets. Frontline BTA teachers, CUPE Local 379 support staff, and retirees accounted for 99.4% of those 23,272 folders. Senior management and HR had 51 folders in that directory.

Staff hired after 2021 were still exposed in other HR directories. Those folders had 354 quarterly workforce compensation dumps from 2013 to 2026 and 196 monthly teacher home-address lists. Monthly private Board spreadsheets also named every teacher and support worker who resigned, retired, or was terminated between 2018 and September 2026, along with their reason for leaving.

Files in "Delete" and "Purged" folders

Sixty-four employee medical notes, disability decisions, and suspension letters were sitting inside subfolders literally named "Delete". Another 121 files for 16 teacher candidates who turned down job offers were kept inside a recruitment folder labelled "Purged".

In a 2020 workplace harassment case folder, HR placed 21 doctor's notes, WorkSafeBC files, and complaint records into a subfolder on the shared drive. The subfolder's name stated that the documents had been removed from the drive per agreement, yet the files were still inside it. On the same server, HR kept a 2015 BCPSEA legal opinion on employee file retention and an internal review of the district's record-retention practices.

Passwords stored in plain text

Next to a folder for Privacy Training, the shared drive had 179 unencrypted files with "password" in the filename and 4 plain-text SQL database connection files. Those files included a dedicated HR password folder, more than 80 new-hire password sheets, and Summer Session student monitor logins. In one accommodation folder, HR saved a password-protected employee medical report email right next to the email containing its password.

Workplace investigation folders on the drive also included a 2024 probation extension and "Security Practices" performance file for one of the district's own IT security staff.

School hazards and private Board files

Internal HR folders and private Board packages up to September 14, 2026, one week before the break-in, covered school safety hazards and labour disputes. Health and safety files included September 2025 internal reports and FAQs on lead in school drinking water and lead-based paint. A separate folder had 94 MB of asbestos reports and 2023 WorkSafeBC orders, plus an internal FAQ on removing portable air purifiers from classrooms.

Education Assistant and staff unsafe-work refusals and WorkSafeBC inspection reports were on file for five schools: Taylor Park Elementary, South Slope Elementary, Gilmore Community Elementary, Moscrop Secondary, and Burnaby North Secondary. Other folders had district office lockdown and panic-button procedures and 27 MB of school floor-plan maps for custodial runs.

Private Board packages included a September 2025 verbal report on rodents and pest control in schools, employer union bargaining mandates, and 2025–2026 strike contingency plans. When SD41 lost a major BTA teacher salary arbitration in 2026, it sent an April 24 letter to the BC Treasury Board asking for special bailout funding. That letter was in the private Board files too.

Student records and job applicants

Three unencrypted online registration SQL database backups totaling 667.3 GB and 859 loose tenancy lease files came from the portal where parents upload scans of permanent resident cards, citizenship papers, visas, driver's licences, leases, and utility bills. For enrolled students, an archive folder had 469.7 MB of unencrypted .txt files from July and August 2022 with final 2021–2022 course marks, teacher report-card comments, daily attendance logs, demographics, and medical alerts. Two MyEducation BC database backups totaling 568.6 MB covered students enrolled between 2024 and 2026.

Another 37.4 GB across 29,649 files on the HR shared drive consisted of job applications, resumes, university transcripts, references, and work permits. Thousands of those files were inside "Not Shortlisted", "Regret Letters", "NOT INTERESTED", and "Declined Offer" folders.