Burnaby cyber attack at the school district: what local businesses can learn

On Monday, September 21, 2026, the Burnaby School District became aware of what it calls a cyber incident, according to the district’s statement. The district said the incident disrupted internal network services and phone lines, and that phone service came back at all schools and district sites on September 28. For owners of small offices nearby, the Burnaby cyber attack is a fair prompt to ask how your own business would get through that same week.

What the district has said about the Burnaby cyber attack

The district’s statement was first posted September 23 and updated September 28. It says the district contained the incident, brought in cybersecurity specialists and notified “the appropriate authorities.” It says it has identified “unauthorized activity” in its network but has “not yet confirmed whether any personal information has been accessed, acquired, or removed.” CTV News reported the same on September 29.

CBC News reported on September 24 that Wi-Fi was also down across the district, which runs 41 elementary and eight secondary schools, and that printers were out as of that Thursday. The district hasn’t said what kind of attack this was or who was behind it, and we won’t guess.

What a week without phones and network means for a 10-person office

Take a 10-person office near Metrotown. If the phones and office network stopped on a Monday morning, the main number would ring out, and a client calling about a deadline wouldn’t know whether you’d closed. Files on a server in the back room would be out of reach, along with the printer.

In a letter to families, the superintendent said students could still use their school email, drives and Microsoft Teams off the district Wi-Fi, and families were asked to report absences by email. An office on Microsoft 365 or Google Workspace can usually keep working the same way from phones and home laptops, as long as those accounts have multi-factor authentication (MFA) turned on.

Phones are harder. Whether your main number can move to staff cell phones in five minutes or five days depends on how your system is set up, and it’s better to learn that on a normal Tuesday than during an outage. Our VoIP phone systems page has more on cloud phones.

Scam calls and emails that use the news

The district asked its community to stay alert for “suspicious communications, including requests for personal information, unexpected emails, text messages, or phone calls.” Chester Wisniewski of Sophos told CBC that criminals sometimes run follow-on scams with stolen details, because “it makes it more believable, because they know something about you.” He was describing a general pattern, and the district has not said any data was taken.

Some of your staff are probably district parents, so a message about the school incident could land in a work inbox. Mention it at your next team meeting: don’t click links or share information in unexpected messages about the incident, and call the school on a number you already have.

Scammers also send email that looks like it’s from a business people already trust, which could be yours. When we checked the public DNS records of 3,392 businesses across 12 industries in the Lower Mainland on September 29, 2026, 84% of the 445 Burnaby business domains we checked weren’t enforcing DMARC, and 59% had no DMARC record at all. These are businesses we researched, not a random sample. DMARC is the DNS setting that tells other mail servers to block email pretending to come from your domain. It won’t stop scam calls or texts, but it makes it much harder for someone to email your clients as you. Our DMARC guide for BC small businesses shows how to check yours.

If this happened to us on Monday: a checklist

The Canadian Centre for Cyber Security’s ransomware threat outlook says every organization in Canada is at risk of being targeted by ransomware at some point, and it names regular software updates, MFA, backups and caution with phishing as the basics that help. That’s general guidance; the district hasn’t said what hit it.

Get Cyber Safe’s page on how to protect your business against ransomware adds regular backups with sensitive copies stored offline and offsite, and an incident response plan you practise with your team. For a small Burnaby office, that plan can fit on one page:

• Keep an offline contact list with staff cell numbers, your IT provider, your insurer’s claim line, your bank and your top clients. Print it and keep a copy at home.
• Know how your main number forwards to cell phones and who can turn that on from outside the office. On most cloud phone systems that’s an app or web setting, while an older on-site system may need someone in the building or a call to your carrier. Try it once on a quiet afternoon.
• Decide who makes which calls. One person contacts IT and the insurer, and another tells staff and clients what’s going on.
• Check that your backups include an offline or offsite copy, and that someone has restored real files from them in the last few months. Our backup and disaster recovery page has more on how we handle this.
• Know where to report. Get Cyber Safe says to report ransomware to the Cyber Centre (through My Cyber Portal or contact@cyber.gc.ca), the Canadian Anti-Fraud Centre and your local police. If client or staff personal information may be involved, the OIPC BC’s breach guide for private organizations under PIPA covers containing it, notifying the people affected and deciding whether to report it to the commissioner.

Umbrella has been based in Burnaby since 2013, and we test client backups by restoring real data on a schedule. Our cybersecurity page covers how we set things up for small offices in Burnaby, Vancouver and New Westminster.

Common questions

Was personal information taken in the Burnaby School District incident?

As of its September 28 update, the district said it had not yet confirmed whether any personal information was accessed, acquired or removed. Its statement page is the place to watch for updates.

Where should a BC business report a cyber attack?

Report it to the Canadian Centre for Cyber Security, the Canadian Anti-Fraud Centre and your local police, as Get Cyber Safe advises. If personal information may be involved, the OIPC BC has an online breach reporting form for private organizations.

If you’d like a second set of eyes on your phones, backups and email settings, a free IT assessment is a good place to start.