Canada’s privacy watchdog investigating hack at Global Affairs

The federal privacy commissioner has opened an investigation into a data security breach detected in January at Global Affairs Canada.

The Office of the Privacy Commissioner said Monday the investigation into the foreign service was launched after it received several complaints.

The investigation will examine the adequacy of the safeguards to protect personal information and assess compliance with the Privacy Act, which applies to federal departments and agencies.

The personal information of users, including employees, was compromised after unauthorized individuals accessed the department’s virtual private network (VPN), the announcement said.

According to CBC News, at least two internal hard drives, as well as emails, calendars and contact lists of many staff members were affected. One government email to staff, seen by the CBC, says data of any staffer who connected remotely by virtual private network between Dec. 30, 2023 and Jan. 24 is at risk.

Related content: OPC investigation into Revenue Canada data breach

Global Affairs told IT World Canada that “early results indicate there has been a data breach and that there has been unauthorized access to personal information of users, including employees.

“The Department is contacting those affected with mitigation measures to ensure that sensitive and personal information is secure. The incident has also been reported to Canada’s Office of the Privacy Commissioner.”

Global Affairs oversees the government’s foreign policy and operates Canadian embassies and consulates around the world. Its minister is a member of the cabinet’s Global Affairs and Public Security committee, which not only deals with diplomatic and trade issues, but also threats and risks to the safety and security of the country.

Discovery of the incident came almost exactly two years after Global Affairs revealed it had been compromised in a cyber attack.

This isn’t the only OPC data theft investigation into a federal department. Last November, it opened an inquiry into the theft of 24 years of data of federal employees from two government-contracted relocation firms. The data, held by Brookfield Global Relocation Services (BGRS) and Sirva Canada, who help move employees transferred as a result of their jobs, was stolen in the hack. BGRS is a relocation management company, while Sirva Canada is a household goods transportation company.

In a separate ongoing investigation, the OPC and three provincial privacy commissioners are looking into OpenAI, the company behind ChatGPT, in response to a complaint alleging the company collects, uses, and discloses personal information without consent. The four regulators are also investigating how TikTok collects the personal data of Canadian users.