Latest News

Fraction of those affected by breach identified

By Joel Wittnebel/The Oshawa Express

Despite extensive efforts, only four of the 18 individuals affected by a December 2015 privacy breach in the city’s printing services department have been identified.

On Dec, 1 it was discovered that a series of pre-authorized tax payment (PAP) notices had been double-stuffed into single envelopes prior to being sent to Canada Post for delivery.

The breach was identified when the number of letters delivered to Oshawa residents didn’t match up with the amount set to be sent out. Following this, more than 13,000 letters were sent to all the participants of the PAP program. A faulty piece of machinery in the city’s printing department was singled out as the cause of the breach.

According to the city’s latest report on the matter, “despite an extensive public notice process” all those affected have yet to be identified. As previously stated in The Oshawa Express, unless those affected come forward, city staff are left with finding a needle in a haystack to identify those individuals.

In an effort to prevent the problem from recurring in the future, along with replacing the worn piece of machinery, staff have implemented a pair of steps to safe-guard against this type of error.

Mailings will be conducted in smaller batches to make detecting errors easier and a verification process has been added to allow for recounts when batches are complete.

It has also be suggested through the city report that printing services develop a regular maintenance program for machinery in order to identify any pieces of machinery that could be causing issues.

The machine responsible for the breach was nearly 10 years old.

The December breach was the second the city experienced in 2015. The first occurred in the city’s recreation and cultural services branch in June, when more than 1,000 email addresses were shared accidentally as a result of the department’s email list being shared in the CC field – which is visible in any email – instead of the BCC field – which is hidden.