Major data breach at one of Canada's largest investment firms 'so dangerous'
A data breach of social insurance numbers (SIN) belonging to the clientele of one of Canada’s largest investment firms is “so dangerous,” according to a former high-level employee at the company.
Terry Beck was the Manager of Operations at Mackenzie Investments, and an employee at the company for nearly 20 years, up until he retired in 2019. When he left, he divested his investments.
Yet a couple weeks ago, he said he received a letter from the corporation explaining that his SIN was compromised in a data breach.
Mackenzie informed clients in a letter dated April 27 that a third-party vendor, InvestorCOM Inc., was compromised by a cyber security incident related to data transfer supplier GoAnywhere. Clients' account numbers, names, and addresses were also compromised, according to one of the letters, reviewed by CTV News Toronto.
“This is so dangerous,” Beck told CTV News Toronto. “It’s an opening of a door to a lot of places.”
To work in Canada or access government programs and benefits, a nine-digit number – known as a SIN – is assigned to an individual. It is “private” and “illegal” for anyone else to use, according to the federal government.
“It’s the gateway to the government,” Beck said.
He said that when he was manager of operations four years ago, SINs were not shared with third-party vendors and that the practice could lead to continued privacy breaches.
A spokesperson for Mackenzie later disputed this fact, telling CTV News Toronto it was not correct.
In a statement on Monday, a Mackenzie spokesperson explained the company now uses SINs to identify and provide notifications to clients.
“Companies may use SINs as an identifier for reasons such as consolidating investor holdings so that fees associated with their account are reduced,” a spokesperson said.
“They may also share a client’s SIN as a unique identifier to third parties such as a dealer, group plan sponsor, and third-party service providers."
Beck acknowledged the necessity of consolidating a client’s accounts, but he questioned why a random set of numbers couldn’t stand in as a unique identifier, instead of a highly sensitive form of government identification.
“It could rear its head at any time down the road,” Beck said.
In a statement issued following the ransomware attack, Mackenzie said it regrets the effects the breach has had on their clientele.
“Mackenzie takes privacy and data protection very seriously and we are committed to protecting the confidentiality of all personal information. We greatly regret any concern or inconvenience this incident may cause to our valued clients,” a company spokesperson said in the statement.
The spokesperson said there has been no evidence of data misuse at this point in time and that the company reported the incident to the federal privacy commissioner, in addition to provincial privacy commissions.
LONG WAITS FOR RESOURCES
Shelly Rae, a Toronto resident and Mackenzie investor of about three decades, said she was concerned when she received a letter in the mail explaining that her personal information had been exposed.
“When someone has your name, phone number, address and SIN, that’s a pretty significant breach,” she said. “They can go on to steal your identity.”
After being notified that her information had been compromised, she said she spent about 10 hours on the phone in an attempt to sign up with a TransUnion credit monitoring service that Mackenzie is offering to impacted customers.
A Mackenzie spokesperson said the company is experiencing "particularly high volumes" of calls, leading to long wait times for victims of the breach seeking resources.
They said they "sincerely apologize" for the delays.
“The TransUnion call centres are doing their best to address all client concerns as quickly as possible by enhancing service capacity to help manage call volumes. We are proactively working with TransUnion to manage the high volume of calls and appreciate people’s patience,” the spokesperson said.
Despite credit monitoring services offered, Beck said “there’s nothing you can do" to change the fact that your SIN number is out there. "It will always be out there," he said.
Mackenzie noted that it is monitoring a range of sources for exposed data and to date have found no evidence of misuse.
CTVNews.ca Top Stories
Young people 'tortured' if stolen vehicle operations fail, Montreal police tell MPs
One day after a Montreal police officer fired gunshots at a suspect in a stolen vehicle, senior officers were telling parliamentarians that organized crime groups are recruiting people as young as 15 in the city to steal cars so that they can be shipped overseas.
'It was joy': Trapped B.C. orca calf eats seal meat, putting rescue on hold
A rescue operation for an orca calf trapped in a remote tidal lagoon off Vancouver Island has been put on hold after it started eating seal meat thrown in the water for what is believed to be the first time.
Man sets self on fire outside New York court where Trump trial underway
A man set himself on fire on Friday outside the New York courthouse where Donald Trump's historic hush-money trial was taking place as jury selection wrapped up, but officials said he did not appear to have been targeting Trump.
Sask. father found guilty of withholding daughter to prevent her from getting COVID-19 vaccine
Michael Gordon Jackson, a Saskatchewan man accused of abducting his daughter to prevent her from getting a COVID-19 vaccine, has been found guilty for contravention of a custody order.
Mandisa, Grammy award-winning 'American Idol' alum, dead at 47
Soulful gospel artist Mandisa, a Grammy-winning singer who got her start as a contestant on 'American Idol' in 2006, has died, according to a statement on her verified social media. She was 47.
She set out to find a husband in a year. Then she matched with a guy on a dating app on the other side of the world
Scottish comedian Samantha Hannah was working on a comedy show about finding a husband when Toby Hunter came into her life. What happened next surprised them both.
B.C. judge orders shared dog custody for exes who both 'clearly love Stella'
In a first-of-its-kind ruling, a B.C. judge has awarded a former couple joint custody of their dog.
Saskatoon police to search landfill for remains of woman missing since 2020
Saskatoon police say they will begin searching the city’s landfill for the remains of Mackenzie Lee Trottier, who has been missing for more than three years.
Shivering for health: The myths and truths of ice baths explained
In a climate of social media-endorsed wellness rituals, plunging into cold water has promised to aid muscle recovery, enhance mental health and support immune system function. But the evidence of such benefits sits on thin ice, according to researchers.