Local coaches, volunteers may be at risk as part of massive data leak

Credit monitoring giant Equifax Inc. won’t reveal whether the personal financial information of any Ottawa-area coaches or volunteers was exposed during a massive data breach earlier this year.

In a bid to cut back on wait times faced by paper applications for background checks, the Ottawa Police Service introduced an online service that allows people to apply for a background check through a website.

It’s a two-part process. The online service uses Equifax to verify the identity of a volunteer, by asking them specific questions about their mortgage, bank accounts or banking institution. If the information matches what Equifax has on file, the applicant is automatically sent to Ottawa Police Service systems to complete the rest of the background check.

Daniel Steeves, chief information officer for the Ottawa Police Service, said he is confident that no information collected by Ottawa police has been compromised. However, he could not speculate about whether any information collected by Equifax, as part of the process, had been breached by hackers.

“I don’t know that for sure. Is it possible? Technically it could be,” said Steeves. “I don’t know the technical details of the breach because they haven’t really disclosed that. I suspect they haven’t disclosed that because they are under investigation by the U.S. regulator that looks after that.”

Steeves said that until Equifax outlines exactly how the hackers got their hands on the financial data of more than 145 million people, he cannot comment on whether anyone applying for a background check in Ottawa was affected. Earlier this year, Equifax revealed that the personal banking and financial information of more than 145 million people may have been compromised by hackers between at least May and July. The information accessed included names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, credit card numbers and other personal identifying information was also believed to have been exposed.

Early estimates suggested the personal information of as many as 100,000 Canadians was included in the data breach. However, the company now says that only 8,000 Canadians have been identified.

Equifax would not comment on how many of those, if any, may have been using the Ottawa Police Service’s new online backgroundcheck service.

“As a matter of policy, Equifax does not comment on the specific services we provide to clients,” said Tom Carroll, a spokesman for Equifax Canada. “We started notifying impacted Canadians by mail October 13th and we have now completed the mailing process.”

Carroll encouraged anyone who wanted more information about the breach to refer to Equifax’s website. Equifax also said it has fixed the issue that gave hackers access to its data.

Richard White, former chief information security officer for the United States Capitol Police, the managing director for Oxford Solutions and course chair for the Cybersecurity and Information Assurance program at the University of Maryland University College, said the questions being asked in Ottawa are an example of how severe the Equifax breach actually is.

“If they used Equifax in any way, for anything; for a credit check, for an identity verification, for an employment record, absolutely they are a potential victim,” said White. “The probability and potential is there, along with any other individual, American or Canadian, who has used the Equifax service for strictly financial services.”

The Office of the Privacy Commissioner of Canada is investigating the breach, but would not comment on specifics “due to confidentiality provisions.”

The new Ottawa police online service was set up to serve anyone who needs a background check, including hockey and soccer coaches and their assistants, summer camp counsellors, those working with the mentally challenged and other people working in volunteer roles or with minors. The police regularly process as many as 50,000 such applications on an annual basis. The force also regularly processes tens of thousands of criminal record checks and police information checks for a myriad of other reasons, including job applications or attempting to enter the United States.

Under the old paper-based system, delays were common. In some cases, delays stretched so long that checks were being provided months after they had been requested. The new system typically sees a check performed in a matter of days.

Police opened the online service to Ottawa residents in May.

The news of the Equifax breach comes at a time when Canadians are growing increasingly concerned about sharing information online. According to a study released by Accenture Canada on behalf of the Canadian Association of Chiefs of Police, more than 53 per cent of Canadians have fallen victim to some sort of cybercrime, which has seen them limit their use of online services. vpilieci@postmedia.com

If they used Equifax in any way, for anything … absolutely they are a potential victim.