More data breaches strike again: millions of customers impacted in Canada and Australia

Oct 1 Blog

            There have been multiple data breaches this week around the world. Continuing from the massive data breach at Uber early in September, there have been a further two separate data breaches recently in Canada and Australia. 

On Sept 29, the Office of the Privacy Commissioner of Canada confirmed that a Canadian border agency suffered a data breach exposing up to 1.38 million licence plate image files and related information (such as the province/state, date, and border crossing site). 11,000 of these were posted on the dark web. The OPC further reported in its investigation that despite such files being considered personal information under the Privacy Act, there were no adequate contractual clauses ensuring that the border agency’s private-sector partner properly protected that information. Ultimately the cause was attributed to improper management of data and inadequate security measures. 

Another investigation in Canada revealed that over 145,000 customers of the Calgary Parking Authority were exposed during a data breach, exposing names, emails, usernames, vehicle info, and addresses. The cause of the breach (which lasted at least 2 months) was an unsecured online logging server, which was accessible by anyone who knew the public-facing IP address. 

 . More recently, in Australia, the telecommunications company Optus suffered a data breach involving over 9.8 million customer records, potentially the worst in Australian history. This included sensitive information such as passports, Medicare, and driver’s licence information, of which 10,000 were posted online (and later copied and spread by other people) by an anonymous person who also demanded a ransom from Optus. For customers whose personal information was leaked, they are currently under high risk of identity theft and financial fraud. This has led to widespread calls in Australia for tougher data protection laws and improved regulation of personal information. 

Data breaches have become more frequently and widespread, to the extent that some consider the data breach as a “question of when, not if”. They demonstrated that all businesses and organizations should be prepared for the possibility (if not eventuality) that they will also suffer a data breach, so that if it happens, they can minimize the damage and consequences through swift responses and demonstration of adequate security measures. The fact that many of the data breaches could have been prevented through proper security measures or data management indicates that better regulation and enforcement of such data protection standards are needed. Additionally, leaked personal information being uploaded onto the 'dark web' demonstrates the importance of protecting against identity theft and regularly checking to see if your personal information could be leaked and used against you - for which it is pivotal for organizations that suffer such data breaches to notify the affected parties quickly.