Lower Mainland cyber roundup: September 2026

This is the first edition of our monthly roundup of Lower Mainland cyber news for small business owners, and September’s biggest local story was the cyber incident the Burnaby School District said came to its attention on September 21. Each month we’ll pick the local stories that matter to a small office, with who reported them and one thing you can do about each.

Lower Mainland cyber news from September 2026

Burnaby School District cyber incident

The district said the incident affected internal network services and phone lines, and phone service was back at all schools and district sites on September 28. As of that update, it had found unauthorized activity on its network but hadn’t confirmed whether any personal information was accessed or taken, and it asked families to watch for suspicious emails, texts and calls. We covered the business lessons in a separate post.

What to do: when a supplier or client reports an incident, confirm any payment or banking request from them by phone for the next few weeks.

TELUS: real breach notices mistaken for spam

CTV News Vancouver reported on September 11 that TELUS, headquartered in Vancouver, emailed some customers to say “unauthorized individuals” could access their name, billing address, phone number and the last four digits of the card on file. TELUS said “a small number of accounts” were accessed between February 2025 and June 2026, and offered two years of free identity protection. On September 17, CTV reported that TELUS staff told some of those customers, including a New Westminster senior, that the real notice was spam. TELUS blamed “an unfortunate technical issue” and said it had been corrected.

What to do: if you ever send customers an important notice, tell them how to check it’s from you, such as calling the number on your website.

Vancouver School Board: phishing from a staff account

In a notice dated September 28, the Vancouver School Board said that “for the second time this month, a compromised staff account was used to send a fraudulent message to some secondary student email accounts.” VSB said its systems quickly removed the message and that it notified BC’s privacy commissioner. It asked people to be careful with unexpected links, attachments and requests for payment or personal information.

What to do: turn on multi-factor authentication (MFA) for every email account in your office, because mail from a real account someone has taken over looks legitimate to spam filters.

BC Provincial Court: fake traffic ticket texts

On August 5, the Provincial Court of British Columbia warned about texts telling people they must attend court for a traffic ticket and should click a link or reply. The court said it “does not send ticket or hearing notices by text message.” The scam link went to bc-court-pay01.xyz, while real BC government websites end in “.bc.ca”. The court asked people to report these texts to BC Crime Stoppers at 1-800-222-8477.

What to do: if staff drive company vehicles, show them this example and how to read the web address in a link before tapping it.

Richmond RCMP: spoofed police phone numbers

Richmond RCMP warned of “an increase in reports of scammers posing as police officers to get bank and credit card information,” Indo-Canadian Voice reported on August 4. One resident gave card details and lost more than $1,000. The report said the scammers use caller ID spoofing, so the call often appears to come from a real police number. Cpl. Eddie Chow told the outlet that police will never ask for card, banking or PIN details over the phone, and advised hanging up and calling back on a number you look up yourself.

What to do: make that your office rule for any call asking for payment or a change to bank details.

Maple Ridge RCMP: the card pickup scam

Maple Ridge RCMP received multiple complaints in recent weeks about callers posing as banks or credit card companies, Maple Ridge News reported on September 11. The callers claim the account is compromised, push for speed, and arrange to pick up cards at the victim’s home. Police said financial institutions “will never send someone to your home to pickup your cards, cash, or information.”

What to do: tell everyone who holds a company card that the bank will never send someone to collect it, and to call the number on the back instead.

Patch this month: SharePoint Server and Citrix

Two national alerts from the Canadian Centre for Cyber Security matter only if you or your IT provider run these products on your own servers, which is uncommon in a small office. On September 24, the Cyber Centre reported active exploitation of a Microsoft SharePoint Server flaw and noted that SharePoint Server 2016 and 2019 reached end of life on July 15, 2026. On September 27, it warned of critical Citrix NetScaler ADC and Gateway flaws with reports of active exploitation. If you’re not sure whether you run either one, ask whoever looks after your IT.

What our Lower Mainland numbers show

When we checked the public DNS records of 3,392 businesses across 12 industries in the Lower Mainland on September 29, 2026, 84% of the 445 Burnaby domains didn’t enforce DMARC, the setting that tells other mail servers to block email faking your domain. Vancouver was at 79% and Richmond at 82%. These are businesses we researched, not a random sample. We also found that 775 of 1,620 DMARC records (48%) had no reporting address, so nobody gets a report when someone sends mail in those businesses’ names.

Enforced DMARC helps mail servers trust email that comes from you and reject fakes of your exact domain, which speaks to the TELUS story, where real notices were taken for spam. It does nothing for scam texts like the court one, and it wouldn’t have stopped what VSB saw, since that mail came from a real account, so MFA matters too. Our DMARC guide explains the setup, and our Cyber Security Awareness Month post has numbers for more Lower Mainland cities.

Common questions

How do I report a scam in BC?

Tell your local police, then report it to the Canadian Anti-Fraud Centre online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501. If you’ve already shared card or bank details, call your bank first.

How can I tell if a breach notice is real?

Don’t use the links or phone numbers in the message. Look up the company’s number on its website or your bill and call, as TELUS invited worried customers to do.

If you’d like someone to look at your own domain’s DMARC and MFA settings before next month’s roundup, book a free IT assessment.