Timeline

Leaked logins before the attack

Before September 2026, security trackers Hudson Rock and ParanoidLab had already flagged thousands of leaked credentials tied to burnabyschools.ca. Three employee computers had been infected with password-stealing malware, exposing 57 student and staff account passwords and 243 third-party vendor logins. Another 6,245 historical domain passwords, with 1,756 marked critical, and 2 active session cookies had leaked in earlier breaches.

Morning of the break-in on September 21, 2026

In the early morning hours of Monday, September 21, 2026, the Qilin ransomware group spent roughly 4.5 hours copying 1.01 TB of unencrypted database backups and Human Resources files before district staff arrived for the day.

File copying began at 3:31 AM in the SQL Server backup directory, which had 40 files totaling 1,034.2 GB. Over the next two hours, the attackers copied 667.3 GB of online student registration database backups, 271.8 GB of IT computer inventory backups, 6.83 GB of document management backups, the 6.81 GB primary district database, and 568.6 MB of MyEducation BC student database backups.

At 6:55 AM, copying moved to the Human Resources shared drive, which had 144,469 files totaling 93.5 GB. Between 6:55 AM and 8:06 AM, the attackers copied teacher and support-staff recruitment folders, all 1,724 paid sick-day requests, and the Youth Services and 2021–2022 plain-text student grade exports. During that same hour, they also copied the 23,272 employee folders inside the "DO NOT USE" archive, workplace investigation files, and private Board of Education HR packages.

File copying inside the HR shared drive stopped at 8:06 AM, and the root directory index was generated at 8:10 AM. The district took network and phone systems offline that day after detecting the attack.

After the attack

Phone service was restored at Burnaby schools and district buildings on September 28, 2026. MyEducation BC access returned on October 1.

File timestamps show the attackers organizing the SQL database folder on their own server on October 15 at 5:28 AM. After ransom talks failed, Qilin published the 1.01 TB dataset of 144,510 files and 39,992 folders on its dark-web leak site on October 26, 2026.