What was already considered a massive data breach for the Durham Regional government, has turned into an even bigger series of unfortunate events as hackers have leaked even more concerning stolen data. The local Ontario government has fallen under heavy scrutiny after a third-party data breach has led to several gigabytes of their data being dumped online by the infamous group of cyber threat actors, CLOP.
The sensitive data, that should have been encrypted, was originally thought to have contained the personal information of tens of thousands of public school students, thousands of children in day care and their vaccination statuses. While the original compromised data was troubling enough, CLOP’s data dump has now exposed even more sensitive files that the government retained such as medical reports, complaints about medical treatment, citizens’ applications for government assistance, and potential evidence in a serious local criminal case.
In an interview with CTV News, Ontario’s former information and privacy commissioner, Ann Cavoukian, spoke to CTV News about the incident and how shocked she was to see such data unencrypted. “The value of encryption is enormous. In this case, when you’re talking about someone hacking, it doesn’t matter what the cause of the interception is, if you encrypt the data, especially sensitive health data, then you’ve protected it from the beginning,”
In a statement on the incident, the region says they have worked with third-party experts to complete an investigation and further action would be taken to “strengthen (their) cybersecurity safeguards.”