Slow response to Oak Bay residents overshadows data breach

Personal information deemed safe despite unauthorized web access

Oak Bay staff are digging deeper into an online security breach this week.

The district immediately shut down one of its online services to protect residents’ personal information after learning of the potential breach July 22, but did not notify residents until late last week.

“We don’t have a full explanation at this point,” said Mayor Nils Jensen.

Residents who use MyDistrict, an online service for tax, utility, bylaw notices, dog and business licence information via oakbay.ca, are now being warned to change their password.

“We weren’t specifically targeted, it seems to be somewhat widespread … there’s no evidence of fraudulent activity on anyone’s bank account,” Jensen added.

The security breach was with a separately hosted and managed site at online.oakbay.ca. “It’s a subdomain of the Oak Bay site,” said Peter Knapp, CEO of Upanup Studios, which designed and hosts oakbay.ca. “It’s a separate service from the Oak Bay site which exists on a separate server.”

Several other municipalities, including the City of Victoria, experienced unauthorized access to their MyDistrict municipal services portal, which was caused by faulty software, on the same date.

The data that was potentially at risk includes personal information of residents who use pre-authorized payment plans for their tax and utility bills. The online service does not collect highly sensitive information such as credit or debit card information, social insurance numbers or drivers’ licence information.

In a letter to affected residents, Oak Bay deputy treasurer and IT manager Fernando Pimental said: “As attacks on high-profile sites are common, we both monitor and improve our site continuously to ensure security at oakbay.ca. We want to err on the side of caution by providing you with the information we have.”

Notice of the security breach was sent to more than 1,000 residents by mail and email. “By Friday all the customers we had email addresses for had received an email from us telling them there might be an issue,” Jensen said.

As a precaution, the district recommends that any residents who have signed up for preauthorized payments monitor their bank accounts and contact their financial institution if they have further concerns. Residents who use MyDistrict are advised to log in and change their password and security question.

Knapp said these types of security breaches are not uncommon. “I don’t want to downplay it, but when you use the term hack it sounds like a person hacked into the site, but in reality, this is more likely a virus.”

By Tuesday morning, the district had received about 20 calls from concerned residents.

“Fernando has been meeting with the bank managers. We’ve provided them with information in regards to what happened,” said district interim CAO Gary Nason. “We continue to have no evidence of any personal information being accessed.”

The affected server was turned off and a new server was brought online on July 23.

Jensen asked Nason to look into the reasons why it took so long for residents to be notified of the security breach. “It was too long, but we can’t say why, at this point, without a full investigation,” Jensen said.

“The mayor asked me to take look at the practices and protocols – and what the other municipalities did – specifically on the issue of why there was a delay in getting the advisory out,” Nason said. “We hope to have the independent security audit findings by the end of next week, if not earlier.”

Jensen said he wants to know, “not only what happened, but how we can avoid it in the future.”

Residents are asked to contact Pimental by email at fpimental@oakbay.ca or by phone at 250-598-3311 during regular business hours if they have any questions or concerns.

 

How do I change my password and security question?

1. Go to oakbay.ca and scroll down to Online Services.

2. Click on the word “MyDistrict Online.”

3. Log on to the service.

4. Select the Profile menu on the left side.

5. Change your security question and then select Update Your Profile.

6. After updating your question, select Change Password and change your password.

 

Just Posted

Protective human chain forms around Victoria mosque for Friday prayer

Islanders stand arm-in-arm to show support in aftermath of New Zealand shootings

City of Victoria announces two more affordable housing projects

The city commits nearly $2M to projects in James Bay and Hillside-Quadra neighbourhoods

Saanich could become the new home of the world’s largest gnome

Galey Farms could find out Tuesday whether it will host the eight-metre-tall structure

Update: BC Transit driver taken to hospital with serious injuries after assault

Driver attempted to stop an altercation between two people on the bus

‘Families torn apart:’ Truck driver in fatal Broncos crash gets 8-year sentence

Judge Inez Cardinal told court in Melfort, Sask., that Sidhu’s remorse and guilty plea were mitigating factors

Greater Victoria Wanted List for the week of March 19

Greater Victoria Crime Stoppers is seeking the public’s help in locating the… Continue reading

POLL: When do you think the next major earthquake will hit Vancouver Island?

According to seismologists, Vancouver Island is overdue for a magnitude 7 earthquake.… Continue reading

WestJet sticking with Boeing 737 Max once planes certified to fly

WestJet had expected to add two more of the planes this year to increase its fleet to 13

B.C. driver caught going 207 km/h on motorcycle along Okanagan Highway

A motorcyclist was caught by Kelowna RCMP going 207 km/h on Highway 97C

Motorcyclist dies after three-vehicle crash on old Island Highway

Accident happened at 12:15 p.m. Friday near Country Club Centre in Nanaimo

B.C. fire department offers tips to keep your home safe during wildfire season

With wildfire season getting closer, the Penticton Fire Dept. offer tips to keep your home safe

Fierce house cat spotted as ‘aggressor’ in face off with coyote in B.C. backyard

North Vancouver resident Norm Lee captures orange cat versus coyote in backyard showdown

Wilson-Raybould to reveal more details, documents on SNC-Lavalin affair

Former attorney general has written to the House of Commons justice committee

Most Read