The District of Oak Bay is warning residents that an external and unauthorized access to personal information may have occurred through one of their web services.
The data that was potentially at risk includes personal information of residents who use pre-authorized payment plans for their tax and utility bills. Also potentially affected are customers who use MyDistrict, an online service for tax, utility, bylaw notices, dog and business licence information. The online service does not collect highly sensitive information such as credit or debit card information, social insurance numbers or drivers’ licence information.
In a letter to affected residents, Oak Bay deputy treasurer and IT manager Fernando Pimental said: “As attacks on high profile sites are common, we both monitor and improve our site continuously to ensure security at oakbay.ca. We want to err on the side of caution by providing you with the information we have.”
Notices are being sent to affected customers by email where available and by mail. As a precaution, the district recommends that any residents who have signed up for preauthorized payments monitor their bank accounts and contact their financial institution if they have further concerns. As a further precaution, residents who use MyDistrict are advised to log in and change their password and security question.
The district learned of the potential breach on July 22 and immediately shut down the online service to protect residents’ personal information.
A review of the server did not find evidence that any personal information had been compromised. The affected server was turned off and a new server was brought online on July 23. An independent security consultant has been hired to audit the breach, and ensure ongoing security. Residents will be notified by the district when more information becomes available.
Residents are asked to contact Pimental by email at firstname.lastname@example.org or by phone at 250-598-3311 during regular business hours if they have any questions or concerns.