By Joel Wittnebel/The Oshawa Express
More than 1,000 email addresses were shared accidentally on May 25 when an email from the city’s recreation and culture services branch was sent out incorrectly.
As part of the department’s standard practice to illicit feedback from residents, an email was sent to everyone who had signed up for city programming through the department. However, the addresses were made public when the list was shared in the CC field of the email instead of the BCC field, which would have kept them invisible to recipients.
No other private information, such as names, addresses, telephone numbers, passwords or banking information was shared in the breach.
“At this point, it’s only the email address that they used to register with the city. So it’s either the email address they used when they registered online with us, or an email address that they provided to us either over the phone or at one of the recreation facilities,” explains Jason McWilliam, the city’s manager of records and information systems.
The email went out to as many as 1,400 addresses. However, McWilliams says as many as 400 of them came back as undeliverable, meaning they are no longer in use.
Anyone that provided an email address when signing up for an arts, culture or recreation program with the city or participated in a fitness or aquatic program during the spring of 2015 would be affected.
An investigation into the breach is currently underway at city hall and the Ontario Information and Privacy Commissioner has also been notified.
“The City of Oshawa takes the issue of protecting personal information seriously,” noted a release from the city.
A report will be filed with the community services committee and pass through council upon conclusion of the investigation. As well, a copy of the report will be shared with the privacy commissioner and any resident impacted by the breach.
The report is aiming to be completed before the council’s summer recess.
At this point, McWilliam, who is a member of the team conducting the investigation, says it is unclear if any disciplinary action will be taken.
“That will be left up to the recreation and culture services branch to determine if there is any kind of disciplinary action or consequences reacquired,” he says.