The Interlock ransomware group has listed Garden Valley School Division in Manitoba, Canada, as a victim, claiming it stole school data in an attack logged on 11 November 2026. The claim appeared on ransomware trackers at 00:43 UTC, naming the division and its website, gvsd.ca, and putting the alleged haul at 1.48 terabytes.

Garden Valley School Division is a public school division based in Winkler, Manitoba, serving about 4,300 pupils. According to the leak-site listing, the attackers claim to have taken student information system databases, including names, dates of birth, grades, attendance records and disciplinary and special education records, along with employee payroll records and bank account details, personnel files, accounting spreadsheets and other administrative files.

The listing is a claim, not a confirmed breach. No verified evidence has yet been published showing that systems were encrypted or that any files were actually taken, and the school division has not confirmed that data was stolen. Analysts tracking the case stress that a leak-site listing is an allegation by the group making it, and should be treated as an intelligence cue rather than proof of compromise until forensic checks are complete.

School confirmed a cyber incident in October

The claim follows a real cybersecurity incident at the division that began weeks earlier. Garden Valley School Division began experiencing network disruptions on 25 October, and on 29 October it said the disruption was caused by a cybersecurity incident. As a precaution, the division took its systems offline, brought in third-party cybersecurity experts and reported the incident to the appropriate authorities.

Phone systems were restored quickly, but other services stayed offline while the division worked to restore them safely. Its superintendent said systems would not be brought back online until the division could be confident in their integrity. The division said it was still assessing whether any data had been compromised and would notify affected people if personal information was found to have been exposed.

That timeline matters because it shows the division was already dealing with a genuine incident before Interlock named it. What is not yet established is whether the October incident and the Interlock claim are the same event, or whether the group is claiming credit for an intrusion it did not carry out.

What Interlock is, and what happens next

Interlock is a ransomware group that follows a double-extortion model, stealing data before encrypting systems and then threatening to publish it unless a ransom is paid. Threat trackers have recorded more than 150 victims linked to the group, with public schools and other education organisations among its frequent targets.

The leak-site post claims the exposure will lead to notifications to affected people under Manitoba's privacy laws, FIPPA and PHIA, and warns of potential penalties. That is the group's own framing in its post, not a finding by the school or by regulators, and no notification has been confirmed.

For parents, staff and pupils, the practical position is unchanged for now: the division has said it will notify people if personal information is found to have been exposed, and its investigation is continuing. Security teams watching the case say the next evidence to look for is a statement from the division confirming or denying data theft, and any sample of stolen data the group may publish to back up its claim.