How SD41 stored it

The "DO NOT USE" folder left behind for up to 7 years

More than 58% of all folders in the breach came from a single directory marked "DO NOT USE". That folder alone accounted for 23,272 folders and 42,622 files, totaling 20.6 GiB. Between 2018 and 2021, HR paid an external scanning vendor to digitize paper employee binders and uploaded the PDFs into eDocs. The 2018–2019 vendor invoices were still sitting in the HR budget folder. After the upload finished, staff added "DO NOT USE" to the old folder name and left the unencrypted scans on the shared drive for five to seven years.

Moving files to folders named "Delete" or "Purged"

In a 2020 workplace harassment case folder, subfolders were set up for the BC Human Rights Tribunal, the Labour Relations Board, and the Ombudsperson. Staff placed 21 doctor's notes, WorkSafeBC files, and complaint records into another subfolder on that same shared drive. They named the subfolder to state that the documents had been removed from the drive per agreement, while leaving all 21 files inside it.

In teacher recruitment, a folder labelled as purged still had 121 files, or 69.0 MB, of personnel files, university transcripts, evaluation notes, and reference checks for 16 named teacher candidates who turned down job offers. In the health and wellness, discipline, and workplace issue directories, 64 employee suspension letters, written warnings, doctor's notes, and medical accommodations were sitting inside subfolders named "Delete".

A 9 MB November 2024 employee discipline hearing package and "Last Chance Agreement" was left inside a Management Committee folder noting the hearing had been cancelled because the employee resigned. Subfolders named "sent to secure server", "REMOVED FILES", and "Uploaded to edocs" still had Employee and Family Assistance Program files, onboarding records, and signed administrator and exempt performance evaluations from July 2022. Another folder named "DELETED O DRIVE FOLDERS DO NOT EVER DELETE THIS FILE" had a copy of Board Policy #5.15 on student and school records, along with scanned employee direct deposit forms and void cheques.

On the same shared drive, HR kept a 2015 BCPSEA legal opinion about employee file retention and an internal Word document titled "HR Records Retention - Current State Process-Analysis".

Multiple copies of discipline and personnel files

A scanning folder on the shared drive had 1,655 workplace investigation files totaling 663.4 MB from more than 160 named employee cases between 2021 and July 2026. The same drive had 64 disciplinary and medical files inside "Delete" subfolders and 439 disciplinary PDFs inside the "DO NOT USE" archive. A separate support-staff folder labelled "USE CAUTION" had another 3,053 files, or 2.33 GB, of CUPE personnel and discipline records.

An HR leader's personal initials folder had 1,124 files totaling 522.5 MiB. That included 449 CUPE discipline files, 196 medical accommodation files, and 150 BTA teacher files. Elsewhere on the drive, HR kept master Word documents tracking overall BTA and CUPE discipline history and 30 years of workplace harassment investigation files dating back to 1996.

Passwords and lockdown guides in plain text

The shared drive had a folder for Privacy Training and a 2024 probation extension and "Security Practices" performance file for one of the district's own IT security staff. On the same server were 179 unencrypted files with "password" in the filename and 4 plain-text SQL database connection files.

A dedicated HR password subfolder had a Word document of application passwords and a PDF for the shared HR mailbox, saved next to a guide on how to add an email account without a password. In an accommodation folder, a password-protected employee medical assessment email was saved right next to the email containing its password.

Other folders had HR system procedure documents with rollout passwords, a CSV spreadsheet of system passwords, and more than 80 individual new-hire password sheets inside orientation folders. Saved Outlook emails included temporary WorkSafeBC account passwords, while Word and Excel files listed Summer Session student monitor logins and passwords. Building security files on the drive included district office lockdown and panic-button procedures, security camera and badge system guides, district office floor and seating plans, and 27 MB of school floor-plan custodial run maps from 2017 to May 2025.

Keeping 43 years of old files on an active drive

The oldest files on the HR drive were teacher seniority lists from 1983, which are 43 years old. Private Board Management Committee and Step 3 CUPE grievance records went back 42 years to 1984, and Board reports went back 38 years to 1988. The drive also had 366 Corel WordPerfect .wpd files from the 1980s and 1990s, workplace harassment investigations from 1996, and archived school psychology evaluations from 2004.

Plain-text student exports and workforce CSVs left unencrypted

Four raw student text dumps from July and August 2022 totaled 469.7 MB, or 448.0 MiB. They covered course marks, daily absences, student demographics, and medical alerts, and were left in an unencrypted folder for four years. Another folder had 354 quarterly workforce .CSV and Excel files from 2013 to 2026 totaling 305.0 MB, and BTA folders kept 196 monthly teacher home-address lists in plain spreadsheets.

Keeping 37.4 GB of job applications

Nearly 30,000 files, or 37.4 GB, on the drive were resumes, university transcripts, reference checks, and immigration work permits in recruitment and regret-letter folders. Thousands of those files were inside folders labelled "NOT INTERESTED", "Declined Offer", "Not Shortlisted", "Regret Letters", and "Purged".