More than a year after Ontario’s vaccine management system was breached, the Ontario government is notifying around 360,000 people that their data was “stolen” and potentially given to fraudsters.
In a statement Friday, the Ministry of Public and Business Service Delivery said the Ontario Provincial Police charged two people in relation to the Nov. 16, 2021 privacy breach of the COVAXon vaccine management system.
“Since then, the Ministry of Public and Business Service Delivery and the Ministry of Health have been working closely with the OPP and the Privacy Commissioner of Ontario to determine the scale and impact of the breach,” the ministry said without offering further details about the breach itself.
But emails sent to thousands of individuals offered greater insight into what led to their names and phone numbers being “stolen” and how the government determined who fell victim to the breach.
The breach, according the government email, allegedly involved a “contracted former employee of the contact centre” and was initially noticed by the Ministry of Health on Nov. 16.
“At that time, some members of the public began receiving financial spam messages to their mobile phones attempting to obtain financial information,” the email from Michael Amato, Ontario’s Chief Information Officer stated.
“In over 95 per cent of these cases a person’s name on its own or with their phone number were stolen.”
It took the OPP just six days to track down and charge two individuals, while seizing their laptops which allegedly contained the stolen data.
“With the arrests of the involved parties within days of the first spam messages being delivered, and the seizure of their laptops, the ministry believes this privacy breach was quickly contained,” the government said in the email.
According to the ministry, beginning Friday, around 360,000 people in Ontario will receive notice that their personal information was part of the breach.
“Ontario’s COVID-19 vaccine booking system is regularly monitored and tested as part of the Ministry of Health’s cyber security protocols and we remain confident that the booking system continues to be a safe and secure tool for Ontarians to use,” the statement read.