Avenue Living data breach hits several tenants
The personal details of some Avenue Living tenant lease applications may have been breached.
The Office of Information and Privacy Commission of Alberta required Avenue Living to notify tenants who may have been affected, by posting notices in newspapers in Medicine Hat, Brooks, Camrose, Edmonton, Lethbridge, Lloydminster and Wetaskawin.
Avenue Living owns and manages multiple rental accommodations across the province, including Medicine Hat.
In November 2016, Calgary Police Services informed Avenue Living management it was conducting a criminal investigation regarding the fraudulent use of personal information to apply for credit cards, and that there was possibly a connection to Avenue Living, say OPIC documents.
An employee of Avenue Living no longer with the company allegedly accessed the employer’s server after hours using a personal device, stole certain tenant personal information, and sold that information for personal gain, the documents say.
The former employee was with Avenue Living from August 2015 to Dec. 5, 2016 and was responsible for dataentry functions and had access to work orders for repairs or complaints about tenants or property. The personal information could include names, addresses, telephone numbers, dates of birth, email addresses, social insurance numbers and signatures.
At the time, lease applications at Avenue Living were not encrypted. The company could not confirm how many application forms may have been compromised but 30 individuals are known to have been affected.
Calgary Police have confirmed its cyber investigations team began in 2016 a complex fraud investigation in this regard.
“It is alleged that an employee of the company used his position to gain personal information from clients, which was then used to apply for fraudulent credit cards,” reads an emailed statement from Calgary Police. “To facilitate the fraud, the employee and three associates allegedly used fraudulent identification to redirect the mail of the victims.”
Calgary police have confirmed charges have been laid against four individuals.
There is one count each of fraudulently redirecting the mail for Chinedu Nwachukwu, 29, of Airdrie; Ken Chinemere Ndu, 43, of Calgary; Charles Amaechi Adikaibe, 39, of Calgary; and Ibrahim Olaolu Lawal-Are, 32, of Calgary.
The 30 individuals known to have been affected were notified of the situation by letter on Jan. 4, 2018, says the OPIC. Avenue Living said it conducted a full review of its “collection and retention policies and practices relating to confidential and personal information.” The company also said it has initiated “privacy controls with the IT department inclusive of automatic password changes” and imposed a limit on call centre personnel accessing the data on the server.
The OPIC said it decided there is no evidence to assert that other Avenue Living tenants, beyond the 30 that were identified, could be harmed by what took place. It said there is the potential for identify theft, fraud, financial loss and email addresses being used for phishing purposes.
Therefore Avenue Living was instructed by OPIC to post notices in newspapers. In locations where Avenue Living has current contact information for those who may have been affected, they have been ordered by OPIC to contact them directly.
Avenue Living did not respond to comment requests from the News this week.
The newspaper notice on the matter published in the Medicine Hat News on May 25 said:
“Avenue Living does not know the specific personal information compromised, but to the best of its knowledge the breach relates to personal information and may include such information as: name, address, date of birth, email address and social insurance number.
“Should you think your personal information has been breached between August and November 2016, or have any questions regarding this matter please contact your local police department or the Avenue Living Call Centre at 1-855247-1492.”