Anyone who's received pay from the University of Victoria in the last two years should take note: your personal information has been compromised.
An electronic storage device with more than 11,000 names, along with social insurance numbers and personal banking information, was taken during a break-in at the university this past weekend.
"We're very concerned given the nature of this crime, and the possibility of future crimes," said Saanich police Sgt. Dean Jantzen. "The issue for us is someone may portray one of the employees with the personal information contained on this media."
The device was stored in a locked safe inside a locked cabinet in an office. It was, police say, an unencrypted backup file containing the personal information for anyone employed at UVic since January 2010. Pensioners are not at risk.
The break-in occurred sometime between Saturday evening and Sunday afternoon to the Administrative Services Building. A ground-floor window was tampered with, and a door forced open.
Police say multiple offices in the wing of the building were entered, many of which were forced open. They believe more than one individual was involved in the break-in.
Inside the offices, many locked drawers and cabinets were breached.
"Our biggest issue now is how do we provide as much information as we can to all the people out there that are concerned," said Gayle Gorrill, UVic's vice-president of finance and operations. "I do want to apologize for the concern and frustration. … We're doing all we can to get them the information they need."
Most of the 11,000-plus individuals were notified Monday afternoon via email that their information had been stolen. Another 700 letters were sent later in the week to employees whose email addresses were out of date.
The university is advising employees to contact their bank or credit union, advise them of the situation, and take whatever steps they recommend. Additionally, employees should contact major credit bureaus asking to flag their file for credit applications.
"If you know what you're doing and have a couple key pieces of information, it's easy to apply for credit these days, like department store credit or online credit," Jantzen said.
The province's information and privacy commissioner is now investigating the incident, and called this incident a "significant" breach of privacy.
"There are obligations under (the Freedom of Information and Protection of Privacy Act), which governs public agencies like the University of Victoria, to protect employees' personal information," said commissioner Elizabeth Denham. She can subsequently issue a public report with recommendations, issue a legal order on an organization, or lay charges under the Act.
Scott McCannell, executive director of the Professional Employees Association, which represents nearly 880 UVic employees, is calling on the university to take better care of their staff's information.
"We have some questions about how this could've occurred in the first place, and appropriate security measures," he said. "We'll be looking to have an understanding of what will flow out of this, in terms of revisions of UVic's security processes and practices. An incident of a similar nature simply cannot take place in the future."
He also said that some members have voiced concern about the timeline of the incident. Though police were made aware Sunday afternoon about the theft, employees weren't notified until Monday afternoon.
"Obviously when we're talking about the risks our members are facing, timely communications should be of the essence," McCannell said.
He's also calling on the university to reimburse employees for all expenses incurred as they look to protect their identities.
The Saanich police investigation is continuing. The building that was targeted was not alarmed, Jantzen said. He would not comment on whether there is surveillance footage of the incident.
As of Tuesday there had been no reports of fraud relating to the data theft, and police are asking that only people who suspect they have been victimized contact investigators. Otherwise, questions and concerns should be directed to the University of Victoria (250-472-4333) or your financial institution.
Anyone with information on the break-in is asked to contact Saanich police at 250-475-4321 or Greater Victoria Crime Stoppers at 1-800-222-8477.
kslavin@saanichnews.com