Pembina Trails School Division listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Canada
• Sector: Education
• Announcement date: January 31, 2025

Rhysida claims data breach at Pembina Trails School Division

The Pembina Trails School Division, a school district based in Winnipeg, Canada, has been listed on the leak site of the Rhysida ransomware group. On January 31, 2025, the threat actors announced that they had obtained data allegedly belonging to the institution. This announcement marks a significant escalation in the ongoing threat landscape facing educational institutions.

The Rhysida group is utilizing a double-extortion tactic in this incident. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to release stolen data publicly, the attackers aim to pressure the victim into paying a ransom. In this specific case, the group has stated that the stolen data will be sold to only one buyer, adding an additional layer of pressure to the extortion attempt.

The group is currently demanding a ransom of 15 BTC to prevent the release of the alleged data. The claim regarding the attack date coincides with the date the information was posted on the leak site, which was January 31, 2025.

Alleged data samples and affected information

While the total volume of data and the exact file count have not been disclosed by the attackers, the group has provided visual evidence to support their claims. The screenshots released by the threat actors appear to show various sensitive documents. These samples include information belonging to the Manitoba School Boards Association, indicating that the scope of the breach may extend to related administrative entities.

The specific types of data identified in the leaked samples include:

• Passport data
• Confidentiality agreements
• Corporate correspondence

The presence of such sensitive documentation poses significant risks to the individuals involved, as these files often contain highly personal and private information used for official identification and legal purposes.

About Pembina Trails School Division

Pembina Trails School Division is a school district serving the south-west communities of Winnipeg, Canada. It operates 34 schools with a student population of approximately 14,000.

Impact and potential risks

The publication of the alleged leaked data may pose a significant risk of identity theft for the employees and students of the institution. When sensitive documents like passports and confidentiality agreements are exposed, the personal information contained within can be exploited by various malicious actors for fraudulent activities. Furthermore, the release of corporate correspondence can create a foundation for targeted phishing attacks, where attackers use specific organizational details to craft highly convincing fraudulent communications.

Under Canada's PIPEDA regulations, the institution may be required to fulfill specific data breach notification obligations to ensure that affected parties are informed of the potential risks to their privacy. The history of the Rhysida group targeting the education sector suggests that the institution's operational continuity could be negatively impacted by such an attack.

Beyond the immediate privacy concerns, the publication of this data may also result in damage to the institution's reputation. For organizations in the education sector, maintaining the trust of students, parents, and staff is paramount. A breach of this nature can undermine that trust and create long-term challenges for the district. To mitigate such risks, organizations typically focus on robust defensive measures, including regular security audits, employee training to recognize phishing, and strict adherence to data protection regulations to minimize the impact of potential unauthorized access.