Thumb drive with confidential Yukon gov't case files found in Whitehorse pawn shop | CBC News

Thumb drive with confidential Yukon gov't case files found in Whitehorse pawn shop

Government, RCMP and privacy commissioner investigating data breach
CBC News · Posted: Oct 14, 2022 5:18 PM CT | Last Updated: October 15

A Whitehorse resident recently purchased a thumb drive at a pawn shop, and then discovered it contained confidential records from the Yukon Department of Health and Social Services. (CBC)
The Yukon government, RCMP and the territory's privacy commissioner are investigating how a thumb drive containing confidential case files belonging to the Health and Social Services department ended up at a Whitehorse pawn shop.

City resident Brian Zink discovered the data after he bought the thumb drive at a pawn shop.

"I spotted some USBs, like a wicker basket just with loose USBs. There's roughly five or six USBs just sitting there," he told CBC.

Zink said when he realized what the files were, he turned the drive over to the Department of Health and Social Services. He also informed the territory's information and privacy commissioner.

CBC has viewed some of the files to confirm their authenticity before deleting them.

The data include confidential case files from the family and children's services branch, including case assessments, reports, budgets, and personal contact information.

The Yukon government issued a news release Friday afternoon reporting the information breach at the Department of Health and Social Services. It says the government was made aware of the breach a day earlier.

A Yukon government cabinet spokesperson told CBC that the government would not comment any further on Friday.

The news release does not include any details about the nature of the information breach or how many people might be affected. It says the government is investigating, along with RCMP and the information and privacy commissioner.

In a written statement, the information and privacy commissioner's office says the government is required to investigate any alleged privacy breach and determine whether it puts anyone "at risk of significant harm."

Yukon education department accidentally leaks student data
"Where a department identifies a risk of significant harm, this triggers a requirement to notify affected individuals, and to provide our office with a breach report outlining what actions they took to mitigate the breach and avoid a recurrence," the statement reads.

The privacy commissioner's office will evaluate how the government handles the matter, including the circumstances leading to the data breach.