U.S.-based company (student information system) data breach: what happened and what to do

What we have on file

Every entry below is a catalogued record with its original source. We do not paraphrase beyond what the source reports.

What to do

1. Change the password anywhere you reused itThe exposure matters most when the same password protects your email, because email is how everything else gets reset.
2. Treat every call and text about this breach as a scam until proven otherwiseNo company will ask you for a one-time code, a PIN or a password. Hang up and call the number printed on your card.
3. Read your statements for the next three monthsCard fraud usually starts with a small test charge. Catching that one is what stops the large one.
4. Give your email account a password nothing else usesIt is the account that can reset all the others, so it is the one worth protecting first.
5. Turn on Autodeposit for Interac e-TransferIt removes the security-question step that scammers try to guess. An e-Transfer cannot be reversed once deposited.
6. Place a fraud alert with Equifax and TransUnionFree, and it forces extra verification before credit is opened in your name.
7. Report losses to the Canadian Anti-Fraud Centre1-888-495-8501. Only 5 to 10% of fraud is ever reported, which is why the numbers you read are understated.

Questions people ask