Employee information may have been accessed in ‘attack’ on Vancouver School Board banking systems

The Vancouver School Board's headquarters is seen in this file photo. (CTV News)

The Vancouver School Board is warning its employees that online attackers may have accessed their personal information during a recent cybersecurity incident.

A letter obtained by CTV News, which was sent to all district staff Friday afternoon, says the VSB “learned of fraudulent activity in connection with our online banking systems” on Wednesday, April 23.

“We took immediate steps to secure our online banking platform,” the letter reads. “However, in the course of investigating this incident, we have learned that some employee information may have been placed at risk.”

The letter describes the incident as an “attack.” It goes on to explain that there is “a potential risk” that those behind the attack “may have unlawfully obtained employee names, bank account details, pay amounts and employees’ VSB identification numbers.”

“The affected bank account information is limited to accounts used by employees for payroll purposes within the last 180 days,” the letter reads, urging employees to closely monitor their accounts in the coming days and contact their banks for further advice on what to do.

In a statement to CTV News on Saturday, the VSB confirmed the incident, saying it had determined that information from employees, tuition fee payers and vendors may have been placed at risk in the attack.

“Our investigation is still ongoing, and we currently do not have evidence that information was accessed,” the VSB’s statement reads.

“Nonetheless, out of an abundance of caution, we are advising all potentially impacted individuals and companies of this incident. It is important to note that this incident does not impact information of other students and their families.”

The school district said it has notified the Vancouver Police Department and is following protocols established by the provincial Office of the Information and Privacy Commissioner.

“We are committed to maintaining the confidentiality of the impacted individuals and are taking protective measures to prevent further fraud attempts,” the statement concludes.