Canadian Mennonite University students, staff victims of cyberattack

Canadian Mennonite University fell victim to a cyberattack that compromised the data of current and former students and employees last month.

School officials became aware of the cybersecurity incident, in which an “unknown third party” accessed its information technology systems without authorization, on Sept. 18, university president Cheryl Pauls said in a recent statement.

The university has since confirmed the third party used that access to steal information from its systems.

“We immediately initiated our incident response plan, retained expert assistance, and informed the university community whose workflows were affected as soon as we became aware of the incident,” Pauls said. “We also reported this incident to law enforcement and will be filing a report with the Office of the Privacy Commissioner of Canada.”

Pauls said experts have now confirmed the stolen data likely includes the personal information of a range of current and former students and employees.

She cautioned the investigation is ongoing and the findings are not yet final, but officials have identified several groups that were likely affected in the breach.

Those include:

— T4 forms of current and former employees from 2015-2025, with name, address, social insurance number, employer name, employee number and earnings information;

— T2202 forms of current and former students from 2019-2025, with name, address, social insurance number, enrolment information and tuition fees;

— T4A forms of students from 2023-2025, with name, address, social insurance number, the name of the university, and the value of the scholarship or bursary;

— TD1 Personal Tax Credits Return and Manitoba Personal Tax Credits Return forms of current and former students for the years 2023-2026, with name, address, date of birth, social insurance number, provincial and federal tax deductions information

— Records of employment of current and former employees for 2020 and between 2023-2026, with name, address, social insurance number, days of employment, total insurable earnings, vacation payout amount and paid leave

University officials have arranged to give all affected access to a complimentary two-year credit monitoring service. Those eligible will receive an email to the most recent contact information the school has on file. Eligible individuals who do not receive an email by Friday should contact the university at privacyquestions@cmu.ca.

“We encourage all eligible current and former staff, faculty, and students to enrol in the credit monitoring service. Accessing this service is important and provides good protections against harms like identity theft and fraud,” said Pauls.

“We are dismayed that education institutions among many other organizations that serve society are often targeted by cyberattacks. These incidents are very hard on communities, and the impacts of this violation on the CMU learning community extend from present students and employees to a range of former students, staff, and faculty.”

fpcity@freepress.mb.ca