Original reporting by Alesia Fieldberg, CTV News Calgary, published July 20, 2026.
Thousands of students, staff and alumni at Mount Royal University in Calgary are still dealing with the fallout from a cyber attack that exposed their personal information. Many have described feeling frustrated and stressed as they wait for answers about what was taken and what happens next. For any organization that holds personal records, the story is a reminder that data security is not just an IT problem. It is a records management problem, and it covers every file you keep, whether that file lives on a server or in a filing cabinet.
What Happened at Mount Royal University
The breach was discovered on June 17, 2026, when attackers accessed the university’s shared file storage systems. Data was copied from the H drive, which held student and employee files, and the J drive holding departmental data was deleted outright, which made it harder for the university to assess the full scope of the damage.
A ransomware group calling itself CMD Organization claimed responsibility and demanded roughly 1.9 million dollars in cryptocurrency, with a six day deadline before threatening to publish everything. The group claimed to be holding more than 10 terabytes of stolen data.
Mount Royal brought in outside cybersecurity experts, reported the incident to the Alberta Information and Privacy Commissioner and to law enforcement, and offered two years of credit monitoring and identity theft protection to current and former employees. Recovery was expected to take weeks or months.
Among the material exposed were passport scans and other highly sensitive identity documents. Once that kind of information is out, it cannot be recalled.
Why Old Records Are the Hidden Risk
The detail that should concern every business owner and administrator is not the ransom figure. It is the fact that former students and former employees were caught up in the breach. People who had not set foot on that campus in years still had their identity documents sitting on a shared drive, waiting to be stolen.
This is the single most common weakness we see across organizations of every size. Records accumulate. Nobody wants to be the person who throws out a file that might be needed someday, so everything stays. Old HR files, expired contracts, photocopied ID, banking details from a payroll change made a decade ago, boxes of client paperwork in a storage room nobody has opened since the last move.
Every one of those records is a liability. If you do not have it, it cannot be stolen. That is the entire principle behind a disciplined records retention and destruction policy.
Paper Records Face the Same Exposure
It is easy to read a story about a ransomware attack and conclude that the answer is better firewalls. Firewalls matter, but they only protect what is on the network. A large share of identity theft still begins with physical documents that were thrown in a recycling bin instead of being securely destroyed.
Paper files do not need a password to be compromised. A single unlocked storage room, an unattended recycling bin at the curb, or a box of files left behind during an office move can expose the same social insurance numbers, banking details and identity documents that hackers went after in Calgary.
Secure document destruction closes that gap. Shredding paper records that have passed their retention period removes them from your risk profile permanently. There is no recovery, no reconstruction and no ransom negotiation.
Digital Media Needs Destruction Too
Deleting a file does not erase it. Reformatting a drive does not erase it either. Old hard drives, backup tapes, USB keys, photocopier hard drives and retired laptops routinely leave organizations with recoverable data still on them.
If your organization is retiring equipment, secure hard drive and media destruction is the only way to guarantee the data is gone. Physical destruction of the drive removes any possibility of recovery, which is a far stronger position than trusting that a wipe was done correctly.
Practical Steps to Reduce Your Exposure
Build a written retention schedule. Decide how long each category of record must be kept to satisfy legal and regulatory requirements, then destroy it once that period ends. Retention without an end date is not a policy.
Run a purge. Most organizations are carrying years of accumulated files they no longer need. A one time bulk purge shrinks your exposure immediately and makes ongoing management realistic.
Use locked collection consoles. Confidential paper should go into a secured container, not an open bin, from the moment an employee is finished with it.
Schedule regular service. Ongoing shredding on a set schedule keeps volume manageable and prevents the backlog from rebuilding.
Destroy digital media properly. Include hard drives, tapes and portable storage in the same policy that governs your paper.
Get certificates of destruction. Documentation proves your organization met its obligations, which matters if you are ever asked to demonstrate compliance.
Security and Sustainability Go Together
Responsible destruction does not have to come at the planet’s expense. At Norfolk Shredding, every sheet of paper we destroy is baled and sent for recycling, where it is turned back into new paper products. Protecting your clients and protecting the environment are part of the same commitment, not competing priorities.
Secure destruction combined with responsible recycling means confidential information is permanently eliminated while the material itself gets a second life. That is a better outcome than a locked storage room full of records nobody needs and everybody is liable for.
The Takeaway
The Mount Royal breach is a case study in how much damage stored data can do when it outlives its purpose. The university will spend months on recovery, and thousands of people will spend years watching their credit. The organizations that come through incidents like this best are the ones that had already gotten rid of what they no longer needed.
You cannot control every attempt made against your systems. You can control how much information is sitting there waiting to be taken.
Protect Your Business With Norfolk Shredding
Norfolk Shredding provides secure, certified document destruction for businesses, healthcare practices, legal firms, financial offices and residential clients across Ontario. We offer scheduled shredding, one time purges, hard drive and media destruction, and certificates of destruction for every service, with all shredded paper recycled.
Call us today at 1-855-561-1716 to arrange a free consultation and find out how simple it is to take your old records off the table for good.
Reference
Fieldberg, Alesia. “‘Frustrated and stressed’: Thousands impacted by cyber attack at Calgary university.” CTV News Calgary, July 20, 2026. Read the original article
