University of Winnipeg finishes cyberattack investigation, finds more groups impacted

The University of Winnipeg has finished its investigation into a cyberattack that crippled the school this spring, and found more people may have been impacted.

According to a release from the university on Thursday, the attack took place on March 25, with the university confirming on April 4 that personal information was exposed and stolen. Information exposed included names, email addresses, social insurance numbers, and banking information.

People initially impacted included students enrolled in undergraduate and graduate programs since 2018, current and former employees of the university since 2003, and students who were issued T4A forms since 2016.

• The information you need to know, sent directly to you: Download the CTV News App
• Sign up now for daily CTV News Winnipeg newsletters

The university said the data was stolen from an encrypted "O" drive that was limited to authorized users.

The list has been expanded to include students at the University of Winnipeg Collegiate from 2018 to 2022, and graduates from the collegiate in 2008-09, 2011-13 and 2018. It also includes international students from 2014 to 2024 and contractors who the university collected a social insurance number from, between 2015 and March 2024.

The university also said people who provided personal health information relating to complaints and concerns over discrimination, harassment, sexual violence or a security incident from 2015 to 2024 were impacted.

A full list of affected groups can be found on the university's website.

"It is disturbing that higher education institutions like the University and other public sector organizations are being targeted by cyber attacks," the university wrote in a statement. "This has been a terrible incident that has directly impacted our community."

The university said it had to examine a large number of files to get the final list of people potentially impacted by the attack.

Free credit monitoring for two years is available to impacted groups.

The university said it does not believe the stolen data has been leaked, but experts continue to watch.