SFU hit by cyberattack involving personal data breach

A post-secondary institution in Metro Vancouver has been hit by a cyberattack, which could mean personal information may have been compromised. 

Simon Fraser University (SFU) issued a statement today (February 16) to notify its community of a cyberattack on one of the school’s server, which thereby exposed personal identifiable information, that took place on February 5.

The university stated the server had spreadsheet data that contained personal information for current and former students, faculty, staff, and student applicants.

The information for each individual varied based on the type of information stored on the spreadsheet. In most cases, the information was the student or employee ID number and a minimum of one other data element. Other data elements included:

• admission or academic standing information, including students who applied for financial aid, academic probation, transcript requests, and student honour awards;
• student group data, including Indigenous students and student athletes;
• data about faculty active in 2018
• student course data, including courses for engineering science and math, and pre-calculus and calculus;
• students with international characters in their names or addresses;

The information did not include banking details, social insurance numbers, or passwords.

SFU states that “the risk of identity theft is low” but all of those people who have been affected should monitor their personal accounts for any unusual activity for the coming months. In addition to possible identity theft, those affected may be at risk for receiving unsolicited bulk or commercial email and third-party profile building.

SFU is directly contacting all affected individuals who have a current email address on file.

Those who want to verify if their information was affected by the breach can:

• check online at the SFU cybersecurity webpage (with an SFU computing ID and password);
• contact the SFU IT Services Help Desk by email or calling 778-782-8888; 
• reviewing information at the SFU website. 

SFU is continuing to conduct a forensic analysis and is working with the Office of the Information and Privacy Commissioner for B.C.

A year ago, SFU had been hit by a ransomware attack on February 28, 2020, which also resulted in a privacy breach of personal data.