Breaches and incidents
Canadian Mennonite University (Winnipeg): third party stole tax-form data of students and employees
CMU said it became aware of a cybersecurity incident on 18 Sep 2026, that “an unknown third party accessed our IT systems without authorization”, and that...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CMU said it became aware of a cybersecurity incident on 18 Sep 2026, that “an unknown third party accessed our IT systems without authorization”, and that “the third party used their access to steal information”; the data likely includes employee T4s (2015 to 2025), student T2202s (2019 to 2025), T4As (2023 to 2025), TD1 forms and Records of Employment.
- Root cause: not disclosed.
- No attacker named (“an unknown third party”).
- CMU retained expert help, reported to law enforcement, will report to the Office of the Privacy Commissioner of Canada, and is offering two years of credit monitoring; the notice corrects an earlier stated T4A range of 2001 to 2025.