Quebec School Board Exposes Parents’ Sensitive Data in Email Breach
Parents at Rosemère High School in Quebec were alerted to a significant data breach after the Sir Wilfrid Laurier School Board accidentally sent an email on Thursday afternoon containing a spreadsheet with the personal information of hundreds of families. The document, attached to an email sent around 3:45 p.m., included names, dates of birth, social insurance numbers, home addresses, phone numbers, and email addresses of parents and guardians though students’ names were not listed.
One affected parent, identified only as A.P. to protect her privacy, discovered her own and her former partner’s sensitive details while reviewing the file. She described the experience as shocking, stating she immediately attempted to contact the school board but received no response. "I was like, 'Oh my God, what have they done?'" she told CBC News. It took the school board 30 minutes to send a follow-up email instructing recipients to delete the message.
The school board issued an apology, acknowledging the severity of the incident. James Di Sano, the board’s chairperson, confirmed the email was only sent to parents of students registered for the 2026-27 school year at Rosemère High School. In a statement, the board urged recipients to permanently delete the email and attachment, avoid sharing the document, and provide written confirmation of compliance. The breach will be reported to the Commission d'accès à l'information du Québec (CAI), as required by law, and an internal investigation will determine the cause and prevent future incidents.
Parents expressed frustration, with many calling the breach "unacceptable" and voicing concerns over potential identity theft. "My information is with people I don’t even know," A.P. said, highlighting the risks of exposed Social Insurance Numbers and birth dates. The incident reflects a broader trend in Quebec, where reported data breaches have surged by 559% over the past three years, according to the CAI.
Rosemère High School TPRM report: https://www.rankiteo.com/company/swlsb
Sir Wilfrid Laurier School Board TPRM report: https://www.rankiteo.com/company/swlsb
"id": "swl1783103120",
"linkid": "swlsb",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Hundreds of families '
'(parents/guardians of students '
'registered for 2026-27 school '
'year at Rosemère High School)',
'industry': 'Education',
'location': 'Quebec, Canada',
'name': 'Sir Wilfrid Laurier School Board',
'type': 'Educational Institution'}],
'attack_vector': 'Human Error',
'customer_advisories': 'Parents advised to delete the email and attachment, '
'avoid sharing the document, and confirm compliance in '
'writing',
'data_breach': {'file_types_exposed': 'Spreadsheet',
'number_of_records_exposed': 'Hundreds',
'personally_identifiable_information': 'Names, dates of '
'birth, social '
'insurance numbers, '
'home addresses, phone '
'numbers, email '
'addresses',
'sensitivity_of_data': 'High (SINs, birth dates, addresses, '
'contact details)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'date_detected': '2023-11-02T15:45:00',
'date_publicly_disclosed': '2023-11-02',
'description': 'Parents at Rosemère High School in Quebec were alerted to a '
'significant data breach after the Sir Wilfrid Laurier School '
'Board accidentally sent an email containing a spreadsheet '
'with the personal information of hundreds of families. The '
'document included names, dates of birth, social insurance '
'numbers, home addresses, phone numbers, and email addresses '
'of parents and guardians.',
'impact': {'brand_reputation_impact': 'Negative public perception, apology '
'issued',
'customer_complaints': 'Parents expressed frustration and concerns '
'over identity theft',
'data_compromised': 'Names, dates of birth, social insurance '
'numbers, home addresses, phone numbers, email '
'addresses',
'identity_theft_risk': 'High (exposure of SINs and birth dates)',
'legal_liabilities': "Reported to Commission d'accès à "
"l'information du Québec (CAI)",
'operational_impact': 'Internal investigation initiated',
'systems_affected': 'Email system'},
'investigation_status': 'Ongoing (internal investigation to determine cause '
'and prevent future incidents)',
'references': [{'date_accessed': '2023-11-02', 'source': 'CBC News'}],
'regulatory_compliance': {'regulations_violated': 'Quebec privacy laws '
'(likely Law 25)',
'regulatory_notifications': 'Reported to Commission '
"d'accès à "
"l'information du "
'Québec (CAI)'},
'response': {'communication_strategy': 'Apology issued, public statement '
'released',
'containment_measures': 'Follow-up email sent instructing '
'recipients to delete the message and '
'attachment',
'remediation_measures': 'Urged recipients to permanently delete '
'the email, avoid sharing the document, '
'and provide written confirmation of '
'compliance'},
'title': 'Quebec School Board Exposes Parents’ Sensitive Data in Email Breach',
'type': 'Data Breach'}