B.C. College Data Breach Exposes Student Info, Sparks Cybersecurity Concerns

Students at the College of New Caledonia (CNC) in Prince George are being warned that their personal information may have been exposed in a cybersecurity breach that went undetected for several months.

In a letter sent out in July, the college said it discovered unauthorized access to its systems on March 5, 2025, but believes the breach could have started as early as October 31, 2024. Exposed data may include student names, phone numbers, email addresses, account usernames, student IDs, and even passwords—some stored in cleartext, a serious security lapse.

Once aware of the breach, CNC brought in cybersecurity specialists and legal counsel to investigate and secure its systems. The school has since set up a dedicated website to answer student concerns but did not provide a clear timeline on when students were officially informed.

Cybersecurity experts say the incident underscores systemic issues across Canada’s post-secondary institutions. Bob Diachenko, a cybersecurity researcher, criticized the college for using outdated practices such as storing readable passwords and noted that months of exposure could have allowed for undetected malicious activity.

Claudiu Popa, co-founder of Canada’s Cyber Safety Foundation, added that student data is particularly valuable for identity theft and phishing schemes. He urged students to report the breach to the provincial privacy commissioner independently to ensure transparency and oversight.

While the college claims there is no evidence that the compromised data has been misused, it is offering a year of free credit and identity protection through TransUnion and myTrueIdentity.

Experts also warn that cybercriminals often wait before exploiting stolen data, making it difficult to assess the true damage immediately. Popa emphasized that many breaches in the education sector go unreported due to poor detection and lack of accountability.

CNC says it has implemented improved cybersecurity measures and staff training to prevent future incidents. School operations and classes have not been affected, but the college has yet to disclose how many students were impacted or the costs incurred from managing the breach.