Pembina Trails School Division Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Pembina Trails School Division, which serves communities in south-west Winnipeg, was listed by the Rhysida ransomware group as of a report dated 2 December 2024. Public detail remains limited: the listing indicates that internal files were exfiltrated in a ransomware attack, but the number of people affected is unknown and no further confirmed inventory of the data has been released.

For families, staff and partners connected to the division’s roughly 14,000 students across 34 schools, the listing raises practical questions about what may have been taken and what steps are available while more information is awaited.

What happened

According to the available record, Pembina Trails School Division was named on a Rhysida-associated leak site. The reported summary states that internal files were exfiltrated in a ransomware attack. Timing of the intrusion itself, the precise method of access, the volume of data involved and any ransom demand are not disclosed in the public facts. The number of individuals whose information may be implicated is listed as unknown. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

The group behind it: rhysida

Rhysida is a ransomware operation that has been publicly documented since mid-2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. The group maintains a dark-web leak site on which it posts victim names and, in some cases, sample files. Prior public activity has included claims against organisations in education, healthcare and government sectors. In this instance the group claims that Pembina Trails School Division’s internal files were taken; no additional statements attributed specifically to this victim appear in the provided facts.

About Pembina Trails School Division

Pembina Trails School Division operates 34 schools serving the south-west communities of Winnipeg and educates approximately 14,000 students. As a Canadian public school division it holds the kinds of records routinely required for education administration: student enrolment and demographic data, staff employment and payroll information, contact details for parents and guardians, and internal operational documents. A breach affecting such an organisation is consequential because the data often include personal information of minors and of employees, and because school systems are essential community infrastructure whose disruption can affect learning continuity and parental trust.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” No further breakdown of file types, record counts or specific categories has been disclosed. Organisations of this kind typically maintain student information systems, human-resources files, email archives and administrative documents; any of these could fall under the broad description of internal files. Because the exact contents remain unconfirmed, it is not possible to state with certainty which data elements were taken.

• Student and family contact or enrolment records (possible but unconfirmed)
• Staff employment or payroll-related documents (possible but unconfirmed)
• Internal administrative or operational files (consistent with the stated claim)
• Any other data held on systems that were accessed (unknown)

What's at stake

If personal information was among the exfiltrated files, affected individuals could face risks of phishing, identity misuse or unwanted contact. For students and families this may involve exposure of addresses, dates of birth or school-related identifiers. Staff could see employment or financial details misused. The division itself faces operational, reputational and regulatory considerations, including the need to notify affected parties under applicable privacy law and to restore any disrupted systems. Because the scale remains unknown, the practical impact cannot yet be quantified; the absence of confirmed numbers does not eliminate the need for caution.

If your data was in this claimed breach

Monitor financial and email accounts for unusual activity and treat unsolicited messages that reference the school division with scepticism. Consider placing fraud alerts with credit bureaus if you believe sensitive identifiers may have been involved. Change passwords on any accounts that reused credentials associated with school systems. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official updates from Pembina Trails School Division or provincial privacy authorities should be regarded as the primary source of further confirmed detail.

AICompiled with AI assistance from public sources and published under our editorial standards.