Two Kitchener men have been accused of stealing sensitive information from a government building. The Waterloo Regional Police Service said a building in the area of Ardelt and Hanson avenues was broken into on July 5. Two suspects stole various items, including records. Officers launched an investigation the following day. The Waterloo Region District School Board warned parents of a privacy breach involving children enrolled in its Extended Day Program. In an email, the board said it became aware of the break-in at its office the day after it occurred. The school board told CTV News the breach involved sensitive information belonging to 36 people. According to the email sent to parents, the stolen Student Plan of Care documents included children’s names, photos, grades, Ontario Education Numbers (OENs), homeroom teachers, schools, dates of birth, emergency contacts and relationships, phone numbers, contact information, medical conditions, symptoms, medications, and names of healthcare providers. The Office of the Information and Privacy Commissioner of Ontario told CTV News the board reported the breach on July 7, 2026, but could not share additional details because the file remains active. Police said they have recovered some of the stolen items, including the records. Officers arrested a 48-year-old man on July 9 and a 46-year-old man on July 13. Police said they were both charged with Break and Enter and are scheduled to appear in court on a later date. A tech expert told CTV News the stolen data could have been spread online before it was recovered. “It’s heartening that the police were able to recover the data. But what happened between the time of the break-in and the time of the recovery is unknown,” said Carmi Levy, a technology analyst and journalist. “So potentially that information could still be out there. It doesn’t take very long, for example, for a criminal to upload that information to the dark web, to make it available to other criminals to buy and sell.” Levy said once information is breached, there is an indefinite risk to the child and their family. “It’s not as if their accounts are going to be broken into right now. What it means is that now more information is in the hands of criminals that can be used to craft even more sophisticated, even more personalized, even more customized phishing messages that look very much like they’re coming from legitimate sources,” Levy said. “Victims can expect to see a greater volume of these kinds of messages in their email inboxes, their text message inboxes, even their social media direct messages.” “In the hands of a predator, for example, this information can be devastating,” he added. “The more information that a predator knows about your child, the easier it becomes for them to weasel their way inside that circle of trust.” The school board’s chief executive officer was not available for an interview Tuesday, but said in an email that the board recognizes parents’ concerns. “The incident was reported to Waterloo Regional Police Service (WRPS) and the WRDSB Privacy Department, and we continue to monitor the situation closely,” WRDSB chief executive officer Scott Miller said in an email. The board is reviewing its practices and processes to protect personal privacy and prevent similar incidents. “We are grateful for the ongoing work of WRPS as they investigate the incident. As the police investigation is ongoing, we are unable to comment further on matters related to the investigation,” Miller added. “Obviously, we’ve always worked hard to street-proof our kids — I’m a parent as well — but that becomes even more pressing as information like this gets out,” Levy said. “It means that a complete stranger can craft a story that makes them look like a very close friend of the family. That increases the risk of this kind of crime toward our kids.” WRPS did not respond to a request for comment, but a police release confirmed the investigation remains ongoing.
