Canadian Mennonite University warns of data breach in cyberattack

Breach of some tax forms covers 10-year range between 2015 and 2025

A cyberattack at Canadian Mennonite University has exposed personal information, including social insurance numbers, of students and staff across a 10-year span.

"An unwarranted third party with intention to do harm got into the system," said Cheryl Pauls, president of the Winnipeg-based university.

“We are sorry that this has happened and we're sorry for the consequences of this. And we are sorry that people choose to engage in this kind of behaviour for whatever reasons they have."

University administration first noticed on Sept. 18 that the school's system had been compromised.

"We immediately closed down whatever we could while we were checking … and immediately got our critical system response plan in action," Pauls said.

Data breaches have all but become a way of life, 'and we're part of the statistics, unfortunately,' says university president Cheryl Pauls. (Canadian Mennonite University)

It then consulted with cybersecurity experts through its insurance provider and determined that T4 and T2202 tax forms issued by the university had been accessed, including names, mailing addresses, and social insurance numbers.

A T4 reports annual employment income and payroll deductions while a T2202 reports a student's tuition tax credit amounts.

The data breach covers a 10-year range between 2015 and 2025 for the T4s and a shorter time-frame for the T2202s, Pauls said.

A notice about the breach was posted on the university's website last week and letters were sent this week to people whose information was compromised. The university is providing access to two years' worth of credit monitoring service, free of charge, to anyone affected.

Just under 4,000 current and former students, staff and faculty were initially believed to have been affected, but after further investigation it appears the personal data of about 20 per cent of those was not compromised, university spokesperson Kevin Kilbrei said in an email.

Out of an abundance of caution, they have been offered the credit monitoring, he said.

The university said in its letter it has "no evidence of misuse of the stolen data," but encouraged anyone who may have been affected to enrol in the credit monitoring service, which it said "provides good protection against harms like identity theft and fraud."

Although it's been nearly three weeks since the breach, Pauls said the turnaround time in notifying people was quite quick.

"We've been told by the experts we're working with that we've been the smoothest and the fastest … to actually get something going publicly that they've worked with," she said.

"It might feel like a delay but it actually had to have some investigation … to even find out what there is to say."

Recovery work continues after ransomware attack at Winnipeg's Health Sciences Centre

Manitoba ombudsman blasts families department for lack of cybersecurity safeguards after 2024 hack

The breach is the latest cybersecurity incident to impact a Manitoba institution, with the University of Winnipeg, Pembina Trails School Division, and the provincial government's families department being hit two years ago, while the Rural Municipality of Gimli and Winnipeg's Health Sciences Centre were targeted earlier this year.

"When there were incidents elsewhere a few years ago, our board asked for a full presentation and anything that had been learned in [those incidents] was then changed within our system," Pauls said.

"[But] our basic understanding of this is we could spend 10 times our university’s entire budget and there would always be new ways that people would cut through systems."

Data breaches have all but become a way of life "and we're part of the statistics, unfortunately," Pauls said. That doesn't mean you don't adapt and continuously learn best practices, she added.

Darren Bernhardt has been with CBC Manitoba since 2009 and specializes in offbeat and local history stories. He is the author of two bestselling books: The Lesser Known: A History of Oddities from the Heart of the Continent, and Prairie Oddities: Punkinhead, Peculiar Gravity and More Lesser Known Histories.

With files from Meaghan Ketcheson