Canadian Mennonite University says tax slips with SINs were stolen in cyberattack
Canadian Mennonite University in Winnipeg says an unknown party broke into its IT systems in September and stole tax records containing social insurance numbers for current and former students and employees.
Tax slips are a valuable target because they combine a name, mailing address and SIN in a single document, the core ingredients for identity fraud. The university is offering two years of free credit monitoring.
What happened
CMU said it became aware on Friday, Sept. 18, that a third party had accessed its systems without authorization, and later confirmed the intruder used that access to steal information. It activated its incident response plan, hired outside experts, reported the incident to police and said it would file a report with the Office of the Privacy Commissioner of Canada. The public notice went up on Oct. 2.
According to the university's notice, the stolen records likely include:
- T4 slips for employees from 2015 to 2025, with SINs and earnings.
- T2202 tuition slips for students from 2019 to 2025, with SINs, enrolment details and fees.
- T4A slips from 2023 to 2025 showing scholarship, bursary or contract amounts.
- Federal and Manitoba TD1 forms from 2023 to 2026, which include dates of birth.
- Records of Employment for 2020 and 2023 to 2026.
CMU corrected an earlier statement that gave the T4A time frame as 2001 to 2025.
How many people
A university spokesperson told CBC that about 4,000 people were initially thought to be affected, but further work found roughly 20 per cent of them had no compromised data. President Cheryl Pauls apologized and said someone with "intention to do harm" had got into the system. The university said it had found no evidence the data had been misused.
What we don't know yet
CMU has not said how the intruder got in, and its investigation is continuing. The DragonForce ransomware group listed the university on its leak site on Oct. 12, according to ransomware.live. The university has not publicly addressed the claim.
What to do
Anyone eligible who has not received an enrolment email should contact [email protected]. Affected people should enrol in credit monitoring, watch for CRA-themed phishing, and check their CRA My Account for unexpected changes to address or direct deposit details.
Key points
- CMU detected unauthorized access to its IT systems on Sept. 18, 2026, and later confirmed data theft.
- Stolen records likely include T4, T2202, T4A, TD1 and Record of Employment data with SINs.
- About 4,000 people were initially thought affected; the university says about 20 per cent were later cleared.
- CMU is offering two years of free credit monitoring and has reported the breach to police.
