The Ontario Science Centre has warned newsletter subscribers of a data breach that occurred after an employee of a third-party contractor was able to access and download personal data without authorization. An undisclosed number of subscribers and camp/birthday party participants were all potentially impacted by the breach.
Company officials have stated that no customer financial information was included in the breach but the financial toll and reputational damage will affect the company nonetheless. Even though the breach was limited to names and email addresses, the information can still be sold for a profit on the Dark Web or used in further Phishing attacks. It is important for the people impacted by the breach to monitor their financials and lookout for identity theft.
Third-party relationships are common practice in business, but it is important to remember to set restrictions and instill Best-Practices when it comes to safeguarding data of any scope. Consequences can be dire, and in the case of the Ontario Science Centre, although they were not directly responsible, it is their reputation on the line and they will be held accountable for any further repercussions.