Who Breached: Passport Canada
Number Affected: unknown
Information breached: Social Insurance Numbers
How: data available online

An Ontario man discovered, while applying for a new Canadian passport, that applicant data was being breached online.

The man discovered that by changing the URL of the page he was on (changing a single character in the URL), he could see the data of other applicants, including social insurance numbers, driver’s license, addresses, phone numbers and other pieces of ID.

“I was expecting the site to tell me that I couldn’t do that,” said Jamie Laning of Huntsville. “I’m just curious about these things so I tried it, and boom, there was somebody else’s name and somebody else’s data.”

This information breach puts an unknown number of people at risk for identity theft. The information breached is sufficient for anybody to take out a new line of credit.

Passport Canada spokesman Fabien Lengelle acknowledges the breach but reports it to be an “isolated anomaly.” Passport Canada took down the website temporarily to fix the issue - however, when it went back online, the problem had not been resolved and was clearly not an isolated incident.

Colin McKay, a spokesman for the office of the federal Privacy Commissioner of Canada, is troubled that all security measures have not been taken to protect these basic documents (the passport being a basic identifying document).

Canada does not have any breach notification laws, and is lagging behind the regulations being created in other countries.

“I think it’s very clear that a strong, mandatory security-breach law is long overdue in this country and it’s cases like these that highlight it,” said Michael Geist, a law professor at the University of Ottawa.

Via nowpublic, globe and mail Tags: data breach, passport canada, security breach, identity theft, government security