Thousands of parents’ personal information leaked in Montreal-area high school security breach

Though people shouldn't panic, cybersecurity expert Claudiu Popa said the school data breach was very serious.

Parents at Rosemere High School on the North Shore of Montreal are concerned after the Sir Wilfrid Laurier School Board sent out an email Thursday afternoon containing parents’ personal information.

The email, titled “ROSEMERE HIGH SCHOOL – Back to School 2026–2027,″ was sent to parents at 3:27 p.m. and included an Excel spreadsheet attachment containing parents’ personal information.

CTV News saw the document, which contained the social insurance numbers, dates of birth and other personal information of over 1,000 parents.

A second email was sent by the school board at 4:11 p.m. with the subject line “URGENT EMAIL TO BE DELETED,” asking parents not to open the first email and to delete it immediately. It also said further instructions would follow.

A third email was sent out at 7:23 p.m., asking parents to complete a form certifying that they had deleted the email and that no copies were made, used or shared.

The school board gave parents until Friday at 4 p.m. to complete the form.

School board is investigating

In a statement to CTV News, the Sir Wilfrid Laurier School Board said it is notifying the Commission d’accès à l’information du Québec, the province’s privacy watchdog, about the incident.

“This incident is being treated with the utmost seriousness. As soon as the school board was made aware of the situation, an email and SMS message was sent to all families concerned asking them to delete the email sent by mistake,” the statement, signed by chairperson James Di Sano, said.

“While the distribution was limited to parents of RHS, we recognize that any unauthorized disclosure of personal information is concerning.”

The statement added that the school board is investigating the circumstances that led to this incident and will implement additional measures to strengthen its processes and prevent a similar incident from happening again.

‘I was already a victim of identity theft’

One parent who contacted CTV News said they were concerned about the potential consequences of the breach.

CTV News agreed not to identify the parents due to privacy concerns.

“I barely slept last night; I was already a victim of identity theft, and it took five years to recover from that,” they said. “This really stresses me out.”

The parent, who has one child attending the school, said they had contacted the appropriate authorities to report that their personal information had been disclosed to more than 1,000 people.

The parent also said they have not signed the form and are speaking with a lawyer about their next steps. They said they are concerned that deleting the first email could affect their ability to pursue legal action.

“The lawyer told me they should have concentrated on damage control, like offering credit monitoring or something,” they said.

“They are kind of cornering us, but if something happens in the future, we cannot really use it legally, so I’m concerned about that.”

Lack of guidance, parents say

Another parent, who has one kid attending the high school, told CTV News that they were disappointed by the lack of guidance on how families should protect themselves following the breach.

“I’m nervous because I don’t know what to do now,” they said. “There hasn’t been a lot of instruction on what we should do now.”

They said they were also upset that it took the school board approximately 45 minutes to send a second email alerting parents.

“When I got the email, I thought maybe it was a cyberattack or an honest mistake; we’re humans, accidents happen,” they said.

“But when I called the school board four minutes after it happened, their response was they were aware and taking care of it, but the second email only came 45 minutes after. I feel that was a bit long.”

They said they already made a complaint with the school board’s ombudsman and the province’s privacy commissioner.

A third parent, who has two kids attending the high school, also expressed frustration over the security breach.

“My social insurance number, all my contact information was leaked, anybody can use that now and steal my identity,” they said.

“I’m calling the bank today; I’m not happy about this.”

‘This goes beyond identity theft’

A fourth parent, who has one kid attending the school, expressed concern about how parents’ personal information was stored.

“I was shocked that all this information was on one document — a document that anyone can access or distribute, and it wasn’t even password-protected,” they told CTV News.

“Usually, this type of information is stored in separate files for each family. I just don’t understand how this is possible.”

Beyond the risk of identity theft, they are also worried about their child’s safety. Their child transferred to the school after experiencing bullying at another high school in Quebec, and the parent had hoped it would offer a fresh start.

“This goes beyond identity theft; I’m worried about the safety of my kid too. The document had our home addresses on it,” they said.

“This affects us all in a way that it might not be today, it might not be tomorrow, but it could in six months from now.”