Personal information belonging to students in B.C.’s Okanagan region has been compromised following a phishing email sent to students last week, according to district officials.On Friday morning, the Central Okanagan School District sent an email to families alerting them to a cybersecurity breach impacting student and staff email accounts.It said district email addresses and first and last names may have been exposed in the breach, and that four accounts, in particular, had been deemed “compromised” and used to send phishing emails to others that included a form asking for personal information.Philipp zu Putlitz’s daughter received the email.”She showed me this email, and at first I went, OK, comes from the district, looks fairly legitimate … and then my partner, she just looked at it and goes, ‘This looks very much like a scam.’ At which point I looked at the email again and went, ‘Wait a second,'” zu Putlitz told CBC’s Daybreak South.Zu Putlitz, who is an IT, surveillance and security consultant, said the email asked for very personal, sensitive information, including banking and credit card details, age, gender, address and details about parents.”The parent is also the target here. It’s not just the student.”He said anyone who did provide that information to the scammer should contact the Canadian Anti-Fraud Centre.LISTEN | Philipp zu Putlitz on Central Okanagan phishing email:The district said Friday it was temporarily shutting down student and staff access to email while its privacy and cybersecurity team investigated the incident.CBC News has requested an interview with the district.Zu Putlitz said a student likely used their school email address for a third-party service, such as a gaming or learning platform, that was subsequently breached, allowing data to be stolen and potentially used to gain access to school email accounts.”If they use single sign-on, there you go, you’re in the next system,” he said.School districts as targets for cyberattacksThe cybersecurity breach in the Central Okanagan comes after a cyberattack on the Burnaby School District in September.That attack shut down phone lines and blocked Wi-Fi access across the district.The school district emailed parents Tuesday with an update, saying the attacker “claims to have published files and information from this incident on the dark web.”The district said information compromised includes names of students, parents and guardians, contact information, birth dates, allergies, CareCard numbers and citizenship documents.100s of breach notifications each year: privacy commissionerThe Central Okanagan breach was reported to the office of B.C.’s privacy commissioner, Michael Harvey.He said cybersecurity incidents like this are happening more and more often.”The last year that we have complete data on which was 2025-2026, those numbers were up almost 50 per cent from the previous year just for public sector organizations,” he said.”We get hundreds of these breach notifications every year.”When someone reports an incident to Harvey’s office, his team helps them ensure it’s contained, communicate with people who need to know and prevent future breaches.Harvey said organizations like school districts should look over their contracts with service providers carefully.”Whatever lawyer’s advising them on the contract that they’re signing with this third party vendor, then they should ask that lawyer … does this work as an information sharing agreement? Does the vendor assess that its product is compliant with B.C. privacy laws?” Harvey said.”No insurance company is going to give cyber insurance to a vendor if they haven’t done their due diligence and made sure that the company has the right safeguards in place.”
——————————————————-
Click Here For The Original Source.
