Ransomware gang claims data theft from Manitoba's Kelsey School Division
A ransomware group has claimed it stole documents about students, parents and staff from the Kelsey School Division in The Pas, Man., weeks after the division told families it was dealing with a cybersecurity incident.
The claim matters because the division had said in November it did not yet know what data, if any, was affected. A leak-site listing suggests the attackers are now trying to pressure the division or sell what they took.
What happened
The division discovered the incident on Nov. 3, 2025, and posted a notice to parents on Nov. 13. Superintendent Trevor Lane wrote at the time that it was unclear what data had been affected. Part of the network was hit, internet access was temporarily cut and some systems were taken offline as a precaution.
On Dec. 29, the Meduza Locker group added the division to its leak site, Comparitech reported. The group claimed to hold "documents for students, parents, staff, and sponsors" and priced the full set at US$40,000. It posted a sample that Comparitech could not verify.
Who is Meduza Locker
Comparitech describes Meduza Locker as a ransomware-as-a-service operation that first surfaced in 2022 and is distinct from the better-known Medusa group. It pointed to a U.S. government advisory that describes the ransomware being deployed through exposed remote desktop services.
What we don't know yet
The division has not confirmed the group's claim, said whether it received a ransom demand, or described what records may have been taken. It did not respond to Comparitech before publication.
What to do
Families and staff should watch for messages that reference student records or the division and ask for personal or financial details, and contact the division office directly to verify any such request.
