It is never pleasant to learn that our sensitive information has been published on the Web. Last January, a criminal group released confidential documents it claims to have stolen from the company Ventilabec. To confirm the authenticity of this information, we contacted people who no longer work for the company, but who unfortunately appear in this data leak.
The ransomware group that claimed responsibility for this cyberattack published 1,140 documents. They include background check authorization forms, job site “onboarding sheets” listing allergies and medication taken, and competency cards issued by the Commission de la construction du Québec. The cards dating from 2010 and 2011 display the worker’s social insurance number. According to a counter displayed on the web page, it has been viewed more than 25,000 times.
Sabrina DesOrmiers worked for Ventilabec until 2012. Afterwards, she “kept doing consulting for them for about two years.” She confirms having signed a criminal background check authorization for a project at the Casino de Montréal. Before our call, no one had notified her of this data breach.
Reached by phone, Caroline (not her real name) confirms that she also worked for this company. She has not been employed there for several years. She asked to remain anonymous.
We informed her that a form was on a website accessible on the dark web. “No one notified me,” she tells us. She confirms having signed this authorization. The document contains information such as her date of birth, her social insurance number and her driver’s licence number.
Ventilabec, based in Laval, specializes in installing and maintaining ventilation, refrigeration and heating systems. According to its website, it has more than 10,000 completed projects to its credit in the industrial, commercial, institutional and pharmaceutical sectors.
Reached by phone, president Éric Ladouceur preferred not to comment on the matter.
Secured or destroyed
According to Steve Waterhouse, a former security officer at National Defence, when archiving this kind of information, it is important to be aware of how sensitive it is.
The best practice for keeping data that is not actively needed is “to never put it online.” He advises storing sensitive data in encrypted form. “There are several programs and tools to encrypt files.” Documents “at rest” should be on an external hard drive, encrypted, and stored in a safe place.
The cybersecurity expert points out that a company should have a data retention policy and destroy data as soon as it is no longer useful. To destroy it securely, he recommends encrypting it before deleting it. This will make it harder to recover.
Reporting not mandatory, but recommended
The Commission d’accès à l’information du Québec (CAI, Quebec’s access to information commission) confirms that the law does not require companies to destroy information. Its spokesperson reminds us that keeping documents that are no longer needed increases the impact when a security incident occurs.
“For now, in Quebec, there is no legal obligation to report security incidents, either to the Commission or to the people concerned,” the CAI told us. Reports are made on a voluntary basis.
“However, we strongly recommend that companies take this step.” According to the Commission, “the people concerned should be notified without delay if the loss or theft of personal information presents a risk of harm to them. This can allow them to take the appropriate measures to protect their personal information.”
The CAI explains that under section 27 of the Act respecting the protection of personal information in the private sector, every person has the “right to access personal information concerning them that is held by a company.” A written request must be submitted.
Article 40 of the Civil Code of Québec also allows a person to request the deletion of personal information that is “outdated or not justified by the purpose of the file.”
In both cases, it is possible to contact the CAI to learn more about the procedures and restrictions detailed in the law.
How to protect yourself from identity theft
According to Patrick Mathieu, co-founder of Hackfest Communication — an annual event and cybersecurity community — in cases like this one, people can protect themselves:
- by avoiding putting personal information on social media,
- by using a password manager and two-factor authentication,
- by subscribing to an alert service such as those offered by Equifax or TransUnion,
- by regularly checking their bank accounts and credit card statements to detect suspicious transactions.
photo credit: spDuchamp - CC BY license
