Slow response to Oak Bay residents overshadows data breach

Personal information deemed safe despite unauthorized web access

Oak Bay staff are digging deeper into an online security breach this week.

The district immediately shut down one of its online services to protect residents’ personal information after learning of the potential breach July 22, but did not notify residents until late last week.

“We don’t have a full explanation at this point,” said Mayor Nils Jensen.

Residents who use MyDistrict, an online service for tax, utility, bylaw notices, dog and business licence information via oakbay.ca, are now being warned to change their password.

“We weren’t specifically targeted, it seems to be somewhat widespread … there’s no evidence of fraudulent activity on anyone’s bank account,” Jensen added.

The security breach was with a separately hosted and managed site at online.oakbay.ca. “It’s a subdomain of the Oak Bay site,” said Peter Knapp, CEO of Upanup Studios, which designed and hosts oakbay.ca. “It’s a separate service from the Oak Bay site which exists on a separate server.”

Several other municipalities, including the City of Victoria, experienced unauthorized access to their MyDistrict municipal services portal, which was caused by faulty software, on the same date.

The data that was potentially at risk includes personal information of residents who use pre-authorized payment plans for their tax and utility bills. The online service does not collect highly sensitive information such as credit or debit card information, social insurance numbers or drivers’ licence information.

In a letter to affected residents, Oak Bay deputy treasurer and IT manager Fernando Pimental said: “As attacks on high-profile sites are common, we both monitor and improve our site continuously to ensure security at oakbay.ca. We want to err on the side of caution by providing you with the information we have.”

Notice of the security breach was sent to more than 1,000 residents by mail and email. “By Friday all the customers we had email addresses for had received an email from us telling them there might be an issue,” Jensen said.

As a precaution, the district recommends that any residents who have signed up for preauthorized payments monitor their bank accounts and contact their financial institution if they have further concerns. Residents who use MyDistrict are advised to log in and change their password and security question.

Knapp said these types of security breaches are not uncommon. “I don’t want to downplay it, but when you use the term hack it sounds like a person hacked into the site, but in reality, this is more likely a virus.”

By Tuesday morning, the district had received about 20 calls from concerned residents.

“Fernando has been meeting with the bank managers. We’ve provided them with information in regards to what happened,” said district interim CAO Gary Nason. “We continue to have no evidence of any personal information being accessed.”

The affected server was turned off and a new server was brought online on July 23.

Jensen asked Nason to look into the reasons why it took so long for residents to be notified of the security breach. “It was too long, but we can’t say why, at this point, without a full investigation,” Jensen said.

“The mayor asked me to take look at the practices and protocols – and what the other municipalities did – specifically on the issue of why there was a delay in getting the advisory out,” Nason said. “We hope to have the independent security audit findings by the end of next week, if not earlier.”

Jensen said he wants to know, “not only what happened, but how we can avoid it in the future.”

Residents are asked to contact Pimental by email at fpimental@oakbay.ca or by phone at 250-598-3311 during regular business hours if they have any questions or concerns.

 

How do I change my password and security question?

1. Go to oakbay.ca and scroll down to Online Services.

2. Click on the word “MyDistrict Online.”

3. Log on to the service.

4. Select the Profile menu on the left side.

5. Change your security question and then select Update Your Profile.

6. After updating your question, select Change Password and change your password.

 

Just Posted

Victoria-born, 16-time Grammy winning musician David Foster penned a letter to the Greater Victoria School District May 7 urging them not to cut music programs. (THE CANADIAN PRESS)
David Foster joins fight to save music in Greater Victoria School District

‘Music is the great equalizer’ Foster wrote in a letter to the district

‘Nindanikoobijiganag: We are Star People’ by Mississauga Nishnaabe Lucbanin artist Estrella Whetung. (Jane Skrypnek/News Staff)
Victoria beadwork exhibit speaks to evolving, enduring nature of Indigenous art

On Beaded Ground features work from West Coast artists and a Cedar Hill Middle School group

Former Victoria HarbourCat and Chicago White Sox player Andrew Vaughn. (Photo courtesy of Chicago White Sox)
Former Victoria HarbourCat hits first MLB home run, adds another two days later

Andrew Vaughn is the first HarbourCat alumni to hit a homer in the majors

A seniors housing complex proposed for Cedar Hill Road in Saanich was supported by council after a public hearing on May 12. (Rendering by Jenson Group Architects)
New 85-unit seniors housing development gets green light from Saanich council

Four-storey rental complex would be located on Cedar Hill Road

Daily confirmed COVID-19 cases reported to B.C. public health, seven-day rolling average in white, to May 12, 2021. (B.C. Centre for Disease Control)
B.C. preparing ‘Restart 2.0’ from COVID-19 as June approaches

Daily infections fall below 500 Friday, down to 387 in hospital

On Friday, May 14 at Meadow Gardens Golf Club in Pitt Meadows, Michael Caan joined a very elite club of golfers who have shot under 60 (Instagram)
Crowds at English Bay were blasted with a large beam of light from an RCMP Air-1 helicopter on Friday, May 14. THE CANADIAN PRESS/Marc Grandmaison
Police enlist RCMP helicopter to disperse thousands crowded on Vancouver beach

On Friday night, police were witness to ‘several thousand people staying well into the evening’

Sinikka Gay Elliott was reported missing on Salt Spring Island on Wednesday, May 12. (Courtesty Salt Spring RCMP)
Body of UBC professor found on Salt Spring Island, no foul play suspected

Sinikka Elliott taught sociology at the university

The first Black judge named to the BC Supreme Court, Selwyn Romilly, was handcuffed at 9:15 a.m. May 14 while walking along the seawall. (YouTube/Screen grab)
Police apologize after wrongly arresting B.C.’s first Black Supreme Court Justice

At 81 years old, the retired judge was handcuffed in public while out for a walk Friday morning

Queen Elizabeth II and Clive Holland, deputy commonwealth president of the Royal Life Saving Society, top left, virtually present Dr. Steve Beerman, top right, with the King Edward VII Cup for his drowning-prevention work. Tanner Gorille and Sarah Downs were honoured with Russell Medals for their life-saving resuscitation. (Buckingham Palace photo)
Queen presents Vancouver Island doctor with award for global drowning prevention

Dr. Steve Beerman receives Royal Life Saving Society’s King Edward VII Cup at virtual ceremony

Former UFV Cascades wrestling coach Arjan Singh Bhullar is now the ONE heavyweight champion after defeating Brandon Vera via TKO in round two on Saturday in Singapore. (ONE Championship)
Former UFV wrestling coach wins MMA championship

Arjan Singh Bhullar captures ONE heavyweight title, first Indian origin fighter to achieve honour

Astra Zeneca vaccine waits for injection in a Feb. 3, 2021 file photo. A Langley man has become the second B.C. resident to suffer a blood clot following an injection. (AP Photo/Frank Augstein)
B.C. man required emergency surgery after AstraZeneca vaccination

Shaun Mulldoon suffered ‘massive blood clot’ after jab

Chilliwack’s Kile Brown, performing as drag queen Hailey Adler, dances and lip syncs in front of hundreds of people during the inaugural Chilliwack Pride Barbecue at the Neighbourhood Learning Centre on Aug. 24, 2019. Monday, May 17 is International Day Against Homophobia, Transphobia and Biphobia. (Jenna Hauck/ Chilliwack Progress file)
Unofficial holidays: Here’s what people are celebrating for the week of May 16 to 22

International Day Against Homophobia, Talk Like Yoda Day, Sea Monkey Day all coming up this week

Most Read