Ransomware Attack on Autism Services of Saskatoon Exposes Personal Data of Over 2,000 Individuals
A ransomware attack on Autism Services of Saskatoon in March 2025 resulted in the theft of sensitive personal information belonging to 2,168 individuals. The nonprofit organization, which provides support to people with autism spectrum disorder and their families, detected the breach on March 20, 2025, after systems became inaccessible. While the organization isolated affected systems and cut network access, attackers had already exfiltrated data.
The compromised information included names, dates of birth, addresses, social insurance numbers, health card numbers, medical details, and credit card information. Despite active monitoring of the dark web in the months following the attack, no evidence emerged that the stolen data was published or used for fraud.
Autism Services notified affected individuals via letter and email on September 3, 2025, offering 12 months of credit monitoring and identity protection services. Saskatchewan Information and Privacy Commissioner Grace Hession David praised the organization’s response but noted the notification lacked details on individuals’ right to file a complaint with her office.
In a statement, Autism Services confirmed its commitment to data protection, emphasizing that it took immediate action upon discovering the breach. The organization has since enhanced its IT security measures. No further malicious activity was detected after the initial incident.
Source: https://www.cbc.ca/news/canada/saskatoon/autism-services-data-breach-privacy-commissioner-9.7311558
Autism Services of Saskatoon cybersecurity rating report: https://www.rankiteo.com/company/autism-services-of-saskatoon
"id": "AUT1787143888",
"linkid": "autism-services-of-saskatoon",
"type": "Ransomware",
"date": "3/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2168',
'industry': 'Healthcare/Social Services',
'location': 'Saskatoon, Saskatchewan, Canada',
'name': 'Autism Services of Saskatoon',
'type': 'Nonprofit'}],
'customer_advisories': 'Offered 12 months of credit monitoring and identity '
'protection services to affected individuals',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '2168',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Dates of birth',
'Addresses',
'Social insurance numbers',
'Health card numbers',
'Medical details',
'Credit card information']},
'date_detected': '2025-03-20',
'date_publicly_disclosed': '2025-09-03',
'description': 'A ransomware attack on Autism Services of Saskatoon in March '
'2025 resulted in the theft of sensitive personal information '
'belonging to 2,168 individuals. The nonprofit organization '
'detected the breach on March 20, 2025, after systems became '
'inaccessible. Attackers exfiltrated data before the '
'organization isolated affected systems and cut network '
'access.',
'impact': {'data_compromised': 'Sensitive personal information of 2,168 '
'individuals',
'identity_theft_risk': 'High (due to exposure of SINs, health card '
'numbers, and credit card information)',
'operational_impact': 'Systems became inaccessible',
'payment_information_risk': 'High (credit card information '
'exposed)'},
'initial_access_broker': {'data_sold_on_dark_web': 'No evidence found'},
'investigation_status': 'Ongoing (no further malicious activity detected '
'after initial incident)',
'lessons_learned': 'Importance of timely and detailed breach notifications, '
"including individuals' rights to file complaints with "
'regulatory bodies',
'post_incident_analysis': {'corrective_actions': 'Enhanced IT security '
'measures'},
'ransomware': {'data_exfiltration': 'Yes'},
'recommendations': 'Enhance IT security measures, ensure comprehensive breach '
'notifications, and provide clear guidance on regulatory '
'complaint rights',
'references': [{'source': 'Original incident description'}],
'regulatory_compliance': {'regulatory_notifications': 'Saskatchewan '
'Information and '
'Privacy Commissioner '
'notified'},
'response': {'communication_strategy': 'Notified affected individuals via '
'letter and email on September 3, 2025',
'containment_measures': 'Isolated affected systems and cut '
'network access',
'enhanced_monitoring': 'Active monitoring of the dark web',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Enhanced IT security measures'},
'title': 'Ransomware Attack on Autism Services of Saskatoon Exposes Personal '
'Data of Over 2,000 Individuals',
'type': 'Ransomware'}