The sharing of a mass email containing sensitive personal information of parents of high school students has some raising questions on securing data.
The email, sent Thursday to parents of children enrolled at Rosemère High School for the 2026-2027 school year, was the result of human error — not a cyberattack or a breach of its information systems, said the Sir Wilfrid School Board.
But the attached spreadsheet contained the personal data of hundreds of parents, including people’s dates of birth, social insurance numbers and contact information.
The email caused panic and anger among some parents, who questioned what to do next.
In a letter to parents on Friday, the school board apologized again and confirmed the sharing of the data was caused by “internal human error.”
But some of the information shared in the email by the school board should be isolated, said Claudiu Popa, a cybersecurity expert and the CEO of Datarisk Canada.
He says the incident highlights the need for the board to review its methods for storing sensitive data.
“What parents should really be concerned about is the fact that their school [board] may be storing information insecurely,” he said.
“It should not be possible for a school or any organization to email out social insurance numbers.”
This type of information needs to be placed “far enough from staff to prevent staff from accessing it, even when their computer gets hacked,” Popa said.
He also said social insurance numbers should exist by themselves, in individual records, but not as compiled lists.
Criminals, he said, target administrators, networks, and human resources departments and immediately look for lists and spreadsheets.
As stakeholders, parents also have a role to play and are entitled to ask questions about where their information is stored, why it’s being stored and ask for proof that processes have improved since the leak, says Popa.
Parents CBC spoke to on Friday said they were still angry and were considering their next steps.
‘Not a malicious action,’ expert says
While parents have the right to be concerned following the email, Popa said they shouldn’t panic.
“This is not a malicious action, and there’s no evidence that malicious people have gained access to the information,” he said.
Popa, however, recommends parents keep all communications and the guidance they’ve received from the school board — with the exception of the spreadsheet containing the personal data.
“They should delete the information that doesn’t belong to them anyway,” he said.
The school board asked parents to delete the information and confirm that they have done so, in a bid to contain the leak.
Popa says parents who are concerned about their personal information being in the hands of others should contact Quebec’s privacy commissioner — theCommission d’accès à l’information du Québec.
The school board itself is under the obligation to report the security breach to the commissioner.