Canadian Mennonite University Data Breach

dragonforce listed Canadian Mennonite University on its dark web portal on October 12, 2026. The Winnipeg-based institution is one of 24 organizations dragonforce claimed in the preceding 60 days, and the only Canadian university in this reporting window. dragonforce’s recent campaign focused on Other, Manufacturing, and Retail & E-Commerce sectors, with the US, Brazil, and Canada as its primary geographies. The Education listing sits outside the group’s most common sector profile, but Canada’s presence as a top-three target geography puts the university in scope. Co-victims from the same window include Medical Department Store (US, Retail), Grupo Industrial Tauro (Manufacturing), Infomedia A/S (Technology), and Franklin Empire (Manufacturing).

Queries against Canadian Mennonite University’s enrollment and account management portal returned approximately 25 credentials. The bulk target a student-facing authentication endpoint using consumer-email usernames — applicant or enrolled student accounts, not institutional staff. A small number of records lacked identifiable institutional usernames, limiting definitive classification. No corporate-domain staff credentials were confirmed in this sample. Credential freshness runs from 2024 through October 2026, with the highest concentration in the weeks immediately before the dragonforce listing. That spike is consistent with active harvesting tied to the intrusion period. Staff credential exposure — not the student-account records — is the higher-risk surface here. Phishing-resistant MFA on staff identity systems and an audit of administrative authentication logs from the weeks before October 12 are the immediate actions. Ransomware operators use infostealer-derived credentials to authenticate into enterprise networks via VPN gateways, SSO systems, and remote desktop services; the student-portal exposure is secondary to securing the institutional identity layer.