Credits: SUN NEWS NETWORK
An employee with Human Resources and Skills Development Canada (HRSDC) lost a USB stick containing social insurance numbers, medical records, birthdates, education levels, occupations and disability payments information.
Friday, HRSDC confirmed the stick was reported missing Nov. 16 at its national headquarters -- more than a month before warning letters to affected Canadians went out -- but gave few details about the security lapse, such as how the stick was misplaced.
A several-day search was mounted, the department said in an email that also revealed the breach affects Canadians nationwide.
"We are contacting approximately 5,000 individuals affected to advise them of the incident and let them know what steps they can take to help protect their personal information," Mathieu Gorley, a department spokesperson said.
"Extensive search efforts have been undertaken and continue. There is no evidence that any of the information has been used for fraudulent purposes."
It's unclear if the information was encrypted, which would make it difficult for unauthorized users to access.
The federal privacy watchdog was notified and is working with HRSDC to figure out what went wrong and how to prevent a repeat, said Anne-Marie Hayden, spokesperson for the Privacy Commissioner of Canada.
"The nature of the personal information involved -- social insurance numbers, information about medical conditions -- is clearly quite sensitive personal information," she said. "It is obviously something we are interested and concerned about."
The privacy commissioner's office was notified Dec. 21 and has since received about 70 calls from Canadians worried about the breach, Hayden said.
There may also be some official complaints filed, which could prompt a formal investigation, she said.
The security gaffe outraged a London woman, informed by mail Wednesday that information she provided to apply for a disability pension is on the lost USB stick.
The letter -- they went out Dec. 19, HRSDC said -- informed her the USB stick "was misplaced by an employee" and contained her name, birthdate, social insurance number, medical conditions, education, occupation and information about other pension or disability payment providers, such as worker's compensation.
Transferring personal information onto USB sticks and other portable electronic storage devices carries an automatic risk, said Ann Cavoukian, Ontario's Information and Privacy Commissioner.
Cavoukian said she couldn't comment on the latest federal incident, but noted "this happens repeatedly. Everyone seems to lose USB keys."