Man, wife arrested after Revenu Québec data hacked

The Sûreté du Québec has arrested two people in connection with a data hack late last month that saw personal information on 23,000 present and former employees of Revenu Québec transferred out of the provincial government agency’s data banks.

Revenu Québec director-general Carl Gauthier broke the news of the breach to employees Wednesday morning, saying they had been victims of a “breach of confidentiality.”

Soon after the announcement, the Sûreté du Québec announced it had arrested a 39-year-old woman and a 46-year-old man in Quebec City in connection with the hack and that a search warrant was being executed in a Quebec City residence. The woman is a Revenu Québec employee and the man is her husband.

Geneviève Laurier, a spokesperson for Revenu Québec, said “we couldn’t reveal any information about the breach beforehand, given the ongoing investigation. But the actions taken by the Sûreté du Québec on Wednesday allowed us to inform our employees of the situation.”

The agency noted the breach was confined to employee information, and data on Quebecers dealing with Revenu Québec had not been compromised.

The data breach, which Revenu Québec says was carried out by a member of its personnel who was suspended from their job the moment the hack was detected on July 25, targeted present and former employees as well as those working at various service centres.

The Sûreté du Québec was informed the moment the agency became aware of the breach.

Revenu Québec said the employee believed to have committed the data breach had legitimate access to the information as part of their job and that the decision to wait until Wednesday to go public about the hack was made in order not to compromise the police investigation.

In a news release posted Wednesday morning, the agency said that for most employees the data taken in the breach included their names and social insurance numbers, but noted that a smaller number of employees also saw their dates of birth and salary details hacked as well.

Revenu Québec noted that its internal investigation found no evidence that any of the stolen information had been used for “malicious purposes” or sold to a third party.

“We have made a list of employees and ex-employees affected so we can communicate with them quickly and inform them of the next steps to take,” Laurier said.

Revenu Québec has 12,000 employees, which means the number of former employees and subcontractors affected by the breach is about 11,000.

The agency has also contacted the province’s Access to Information Commission so “all appropriate action is taken quickly to ensure that such an incident does not recur.”

All victims of the breach will be contacted by mail, the agency said, and measures will be made to help them guard against any illegal use of their personal data.

The agency has also set up a website to assist those affected by the data theft.