Yukon education department accidentally leaks student data | CBC News
Yukon education department accidentally leaks student data
Social Sharing
Facebook
Twitter
Email
Reddit
LinkedIn
The breach included personal data of more than 500 students
Chris Windeyer · CBC News · Posted: Sep 23, 2022 1:42 PM CT | Last Updated: September 23
The Yukon Department of Education building in Whitehorse. A recent privacy breach within the department saw the names, phone numbers, email addresses, dates of birth and social insurance numbers of more than 500 students accidentally shared in an email. (CBC)
A few errant keystrokes by an education department worker exposed the data of more than 500 Yukon students, according to a notification obtained by CBC News.
"[T]he breach involves a risk of significant harm to your privacy," reads the letter to affected students. The letter says names, phone numbers, email addresses, dates of birth and social insurance numbers were all included.
The leak took place when a department employee included an unidentified person's email address when forwarding a spreadsheet containing the data of students who applied to a post-secondary grant program to colleagues. Staff attempted to contact the person, the letter says, going so far as contacting their workplace.
"It's concerning to me that someone didn't double check this email before they hit send," said Fiona, a Whitehorse parent whose daughter was affected by the breach. CBC has agreed to withhold her last name so as not to compound the privacy breach because her daughter is a minor. Fiona shared a copy of the letter that was sent to her daughter.
Eventually, education department staff were able to contact the person who received the email, said David McInnis, the department's privacy officer. He said the person got the email because of an auto-fill error. But he said they never opened the email and agreed to immediately delete it.
"The individual is a Yukon citizen, they understand the situation and they're working with us in the best interest of their fellow Yukoners," McInnis said.
The data leak happened on Aug. 24, but Fiona's daughter wasn't notified until more than three weeks later: Sept. 15. Fiona is unhappy about that, too. "A phone call would have been appreciated on the day it happened," she said. "Not waiting, sending a letter in the mail, which we get almost a month later."
McInnis said the department first tried to contact the recipient of the errant email and arranged for credit monitoring for people affected by the breach.
He said the department is stepping up training to prevent similar breaches from happening again.
"Yukon government employees have access to the secure file transfer tool that ... should be used in an instance like this," McInnis said.
In an email, a spokesperson for the Office of the Information and Privacy Commissioner said the office "is aware of the breach, and will work with the Department of Education to ensure it has met its obligations under the Access to Information and Protection of Privacy Act."
The spokesperson said people can still file a complaint to the privacy commissioner's office.
Social Sharing
The breach included personal data of more than 500 students
Chris Windeyer · CBC News · Posted: Sep 23, 2022 1:42 PM CT | Last Updated: September 23
The Yukon Department of Education building in Whitehorse. A recent privacy breach within the department saw the names, phone numbers, email addresses, dates of birth and social insurance numbers of more than 500 students accidentally shared in an email. (CBC)
A few errant keystrokes by an education department worker exposed the data of more than 500 Yukon students, according to a notification obtained by CBC News.
"[T]he breach involves a risk of significant harm to your privacy," reads the letter to affected students. The letter says names, phone numbers, email addresses, dates of birth and social insurance numbers were all included.
The leak took place when a department employee included an unidentified person's email address when forwarding a spreadsheet containing the data of students who applied to a post-secondary grant program to colleagues. Staff attempted to contact the person, the letter says, going so far as contacting their workplace.
"It's concerning to me that someone didn't double check this email before they hit send," said Fiona, a Whitehorse parent whose daughter was affected by the breach. CBC has agreed to withhold her last name so as not to compound the privacy breach because her daughter is a minor. Fiona shared a copy of the letter that was sent to her daughter.
Eventually, education department staff were able to contact the person who received the email, said David McInnis, the department's privacy officer. He said the person got the email because of an auto-fill error. But he said they never opened the email and agreed to immediately delete it.
"The individual is a Yukon citizen, they understand the situation and they're working with us in the best interest of their fellow Yukoners," McInnis said.
The data leak happened on Aug. 24, but Fiona's daughter wasn't notified until more than three weeks later: Sept. 15. Fiona is unhappy about that, too. "A phone call would have been appreciated on the day it happened," she said. "Not waiting, sending a letter in the mail, which we get almost a month later."
McInnis said the department first tried to contact the recipient of the errant email and arranged for credit monitoring for people affected by the breach.
He said the department is stepping up training to prevent similar breaches from happening again.
"Yukon government employees have access to the secure file transfer tool that ... should be used in an instance like this," McInnis said.
In an email, a spokesperson for the Office of the Information and Privacy Commissioner said the office "is aware of the breach, and will work with the Department of Education to ensure it has met its obligations under the Access to Information and Protection of Privacy Act."
The spokesperson said people can still file a complaint to the privacy commissioner's office.
