Listen to this article
Estimated 4 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
Parents at Rosemère High School (RHS) in Quebec are expressing their concern after the Sir Wilfrid Laurier School Board sent out an email Thursday afternoon, with an attached document containing parents personal information.
Several parents who spoke to CBC News said they received the email from the school board at around 3:45 p.m. and immediately tried reaching the board to alert officials of the breach.
That was the case for A.P., the mother of a student who will be starting at RHS in the fall.
CBC agreed to withhold A.P’s name as to not further expose her personal information and that of her family due to the information breach.
A.P. says she was at work when she got the email and promptly opened the attached document, but wasn’t sure what she was looking at, or looking for.
As she scrolled through the spreadsheet, she said she saw her former partner’s name, his date of birth and his social insurance number.
Then with a bit more scrolling, she found her own name and sensitive personal information.
“I was like, ‘Oh my God, what have they done?,'” she said. “I tried to contact the school, and no one answered me, and I tried to contact the school board and nobody answered me.”
CBC News has seen the document that was shared in the email and can confirm the Excel spreadsheet includes the personal information of hundreds of parents.
The document includes not only the names of parents and guardians, but the birth dates and place of birth of each parent and their social insurance numbers.
The list also includes parents’ contact information including email addresses, home addresses and phone numbers. Emergency contact information is also provided, but students’ names are not listed.
A.P. said it took a full half hour before the school board sent out a second communication asking parents not to open the first email and to delete it.
“But what was done, was done,” A.P. said.
School board asking parents to delete email
In a statement to CBC News, the Sir Wilfrid Laurier School Board said it understands that parents are feeling upset and concerned and apologized for the security breach.
“This incident is being treated with the utmost seriousness,” the statement, signed by chairperson James Di Sano reads.
The board said the email was only sent to parents with a child registered at Rosemère High School for the 2026-2027 school year.
WATCH | Data breaches on the rise in Quebec:
Data breaches in Quebec are on the rise. How safe is the province’s new digital health records system?
Data breaches in Quebec are on the rise, with a 559 per cent increase in reported incidents over the past three years, according to the Québec Access to Information Commission. Cybersecurity researchers say medical records are the most lucrative type of data, selling for $250 to $1,000 per person.
Di Sano reiterated that anyone who received the email should delete it and the attachment from their inbox and from their deleted items, and that parents will be asked to provide a written confirmation that this has been done.
“In addition, it is important not to save, copy, print, post, forward or share the email in question as to avoid further breaches,” he said.
Di Sano said the matter will be reported to the Commission d’accès à l’information du Québec (CAI), in accordance with the board’s legal obligations.
The CAI is a government body and an administrative tribunal that oversees the enforcement of laws regarding the protection of personal information.
The school board says it will also investigate the circumstances that led to the breach in the first place and will implement additional measures so that it doesn’t happen again.
‘Unacceptable,’ parents sayWATCH | Tips on protecting your personal information after a data breach:
Caught in a data breach? 3 tips for what to do next
Cybersecurity expert Robert Falzon, Canadian head of engineering at Check Point Software Technologies, shares his top three tips of what students and staff impacted by the Canvas cyber incident should be doing next.
A.P. confirmed she received a third email asking for confirmation she had deleted the email and would not use the information it contained, but as far as she is concerned, it’s too little too late.
“My information is with people I don’t even know,” she said. “I don’t trust them, I don’t know them and now they have my social security number and my date of birth.”
A.P. said she understands human error is possible but nonetheless, the experience has left her feeling powerless and unsure of what to do next.
Having access to sensitive personal information can “destroy lives,” if it falls into the wrong hands, A.P. said.
“It’s sad and it’s unacceptable.”
It’s a sentiment that was echoed by numerous parents CBC spoke to on Thursday, and by others who voiced their concerns on social media.