Manitoba Cyberattack Lessons for Small Business: What Happened and What to Do

2026-10-26 · 9 min read

Why these incidents, and what is missing from them

Private Manitoba businesses rarely publish the story of a cyberattack. Public bodies do not get that choice: school divisions, universities and government departments answer to the Manitoba Ombudsman and to the public, so their incidents leave a paper trail. That is why every incident below involves a public body or one of its suppliers. We found no verifiable, publicly documented cyberattack on a named Manitoba private small business that we were willing to cite, so we have not invented one. What we can do is read the public record closely and pull out lessons that apply to any organization with the same technology.

Each entry notes where the facts come from. Where we could not open a primary page ourselves, we say so.

Four documented Manitoba incidents at a glance

Pembina Trails School Division: a slow, long tail

The division's own page puts the incident date at December 2, 2024. Its last web update before the final one was May 1, 2025, when it confirmed that certain files from its systems had been posted to parts of the internet that the general public cannot easily reach with ordinary browsers. The final update, dated December 3, 2025, says the data mining review is finished, the affected groups and data categories are identified, and the division expects no further updates (Pembina Trails). The division's advice to families is practical and worth copying into your own customer notices: remain cautious with emails, mail, texts and calls, be especially wary of any message that asks for personal information or contains links, and talk with children about the same precautions.

News coverage from CBC, which we found through search results but could not open directly, reported that the group Rhysida was behind the attack, that the division said it did not pay the ransom, and that the group later posted data online.

The lesson is the timeline, not the headline. From the attack to the final notice took about a year. Scoping which records were affected is slow work, and it is much slower when nobody knows where old data lives. The affected range runs back to 1999 for students and 2001 for staff, which means information was being kept for 20 years or more. Every record you delete on schedule is a record that cannot be stolen later, and cannot extend your notification list.

University of Winnipeg: file servers hold more than anyone remembers

The University of Winnipeg detected its attack on March 24, 2024, and CBC reported the investigation concluded that personal data, including social insurance numbers, had been stolen from a file server, affecting current and former students, employees and contractors (CBC News).

A university is bigger than any small business, but the failure pattern scales down well. File shares collect scans of ID, payroll exports, signed forms and spreadsheets that someone saved once and never moved. A small accounting or dental office has the same drift. The practical lesson: know what sensitive data sits on shared drives, restrict who can reach it, and clean it out.

PowerSchool: when the supplier is the weak point

In February 2025 the Manitoba Ombudsman told the public that school divisions across the province using the PowerSchool platform were dealing with privacy breaches. PowerSchool reported "unauthorized exfiltration of certain personal information" from its systems. The Ombudsman made two points that every small business should read twice. First, the affected divisions still had to report their breaches to the Ombudsman under FIPPA and PHIA once they found a real risk of significant harm. Second, PowerSchool, as a private company, was not a public body or trustee, and the federal Privacy Commissioner had jurisdiction over it; the federal Commissioner announced an investigation on February 11, 2025 (Manitoba Ombudsman).

The lesson: you can do everything right internally and still get a call because your supplier was breached. Your duty to assess and report does not disappear because the attack happened on someone else's servers. Keep a current list of who holds your data, and keep their contact for security incidents somewhere you can find at 2 a.m.

Manitoba Families: the report that spells out the oversight gap

The most recent entry is also the most instructive, because the Ombudsman wrote down what went wrong in management terms. A community-based provider, funded and contracted by Manitoba Families under a service purchase agreement and serving Community Living disABILITY Services clients, suffered a cybersecurity incident that led to unauthorized access to personal and personal health information of 1,361 Manitoba residents. The Ombudsman's central finding was that Families "did not have service provider management policies, security control guidelines, or an active audit program" for its provider's privacy practices, including cybersecurity. Five recommendations followed, Families responded on May 25, 2026, and the report is dated May 28, 2026. The public summary does not describe how the provider was breached, and we do not speculate (Manitoba Ombudsman, MO-09540).

The lesson: a signed contract is not oversight. Having a vendor on paper does not replace asking what they do, checking occasionally, and having a rule about what security a supplier needs before it touches your data.

The national numbers behind the local stories

Statistics Canada's survey of businesses with 10 or more employees for 2023 gives the national backdrop. It found 16% of businesses were impacted by cyber security incidents (down from 18% in 2021 and 21% in 2019), and 30% of large businesses. Of impacted businesses, 13% reported ransomware, and most of the ransomware victims, 88%, did not pay. Scams and fraud were the most common method, cited by 50% of impacted businesses, and identity theft affected 31%. Spending on recovery was about $1.2 billion, roughly double the 2021 figure, while spending on prevention and detection was about $11.0 billion, of which small businesses accounted for $2.6 billion (Statistics Canada, The Daily, October 21, 2024). The page contains no Manitoba-specific breakdown, so we do not offer one.

Two readings of those numbers are fair. Incidents are common but not universal, and spending on prevention dwarfs spending on recovery: most of the money is going where it should. For a small Manitoba firm the takeaway is not panic, it is proportion.

What to do: a response sequence that fits one page

These steps follow the structure the Manitoba Ombudsman and the Privacy Commissioner both describe: contain, assess, notify, then prevent a repeat. Adjust names and tools to your business.

1. Contain. Disconnect affected devices from the network, change passwords and revoke sessions for affected accounts, and preserve logs. Do not wipe machines before you know what was taken.
2. Call your response team. Your IT provider, your cyber insurer (many policies require early notice), and a lawyer if health or other sensitive records are involved. Our incident response plan guide has a fill-in template.
3. Work out what information was involved. Names, SINs, bank details, health information? Whose: customers, employees, patients?
4. Apply the harm test. Ask how sensitive the information is and how likely it is to be misused. If there is a real risk of significant harm, notify the affected people and the right regulator: the Privacy Commissioner of Canada under PIPEDA, or the Manitoba Ombudsman if you are a public body or PHIA trustee. Our guide to who regulates what in Manitoba shows how to tell.
5. Record it. Log every breach, reportable or not.
6. Tell people in plain language. Say what happened, what information, what you are doing, and what they should watch for. Pembina Trails' advice to stay alert to unexpected messages is a good model.
7. Fix the cause, then review. Patch, enable multi-factor sign-in, remove stale data, and add the lesson to your plan.

If the demand is ransomware, read should you pay a ransom before anyone replies to the attacker, and keep ransomware protection basics in mind for the rebuild.

Prevention that matches the failures

The Canadian Centre for Cyber Security's 13 baseline controls cover most of this ground, and our pages for Winnipeg and Brandon explain how a managed provider typically delivers them. For costs, see the Manitoba managed IT cost guide, and for the wider picture start with managed IT services in Manitoba and the national Small Business Cybersecurity hub. Services are delivered remotely with hands-on work fulfilled by our partner IT Cares in Quebec; on-site availability is confirmed case by case in writing.

FAQ