Slow response to Oak Bay residents overshadows data breach

Personal information deemed safe despite unauthorized web access

Oak Bay staff are digging deeper into an online security breach this week.

The district immediately shut down one of its online services to protect residents’ personal information after learning of the potential breach July 22, but did not notify residents until late last week.

“We don’t have a full explanation at this point,” said Mayor Nils Jensen.

Residents who use MyDistrict, an online service for tax, utility, bylaw notices, dog and business licence information via oakbay.ca, are now being warned to change their password.

“We weren’t specifically targeted, it seems to be somewhat widespread … there’s no evidence of fraudulent activity on anyone’s bank account,” Jensen added.

The security breach was with a separately hosted and managed site at online.oakbay.ca. “It’s a subdomain of the Oak Bay site,” said Peter Knapp, CEO of Upanup Studios, which designed and hosts oakbay.ca. “It’s a separate service from the Oak Bay site which exists on a separate server.”

Several other municipalities, including the City of Victoria, experienced unauthorized access to their MyDistrict municipal services portal, which was caused by faulty software, on the same date.

The data that was potentially at risk includes personal information of residents who use pre-authorized payment plans for their tax and utility bills. The online service does not collect highly sensitive information such as credit or debit card information, social insurance numbers or drivers’ licence information.

In a letter to affected residents, Oak Bay deputy treasurer and IT manager Fernando Pimental said: “As attacks on high-profile sites are common, we both monitor and improve our site continuously to ensure security at oakbay.ca. We want to err on the side of caution by providing you with the information we have.”

Notice of the security breach was sent to more than 1,000 residents by mail and email. “By Friday all the customers we had email addresses for had received an email from us telling them there might be an issue,” Jensen said.

As a precaution, the district recommends that any residents who have signed up for preauthorized payments monitor their bank accounts and contact their financial institution if they have further concerns. Residents who use MyDistrict are advised to log in and change their password and security question.

Knapp said these types of security breaches are not uncommon. “I don’t want to downplay it, but when you use the term hack it sounds like a person hacked into the site, but in reality, this is more likely a virus.”

By Tuesday morning, the district had received about 20 calls from concerned residents.

“Fernando has been meeting with the bank managers. We’ve provided them with information in regards to what happened,” said district interim CAO Gary Nason. “We continue to have no evidence of any personal information being accessed.”

The affected server was turned off and a new server was brought online on July 23.

Jensen asked Nason to look into the reasons why it took so long for residents to be notified of the security breach. “It was too long, but we can’t say why, at this point, without a full investigation,” Jensen said.

“The mayor asked me to take look at the practices and protocols – and what the other municipalities did – specifically on the issue of why there was a delay in getting the advisory out,” Nason said. “We hope to have the independent security audit findings by the end of next week, if not earlier.”

Jensen said he wants to know, “not only what happened, but how we can avoid it in the future.”

Residents are asked to contact Pimental by email at fpimental@oakbay.ca or by phone at 250-598-3311 during regular business hours if they have any questions or concerns.

 

How do I change my password and security question?

1. Go to oakbay.ca and scroll down to Online Services.

2. Click on the word “MyDistrict Online.”

3. Log on to the service.

4. Select the Profile menu on the left side.

5. Change your security question and then select Update Your Profile.

6. After updating your question, select Change Password and change your password.

 

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Students from SD62 stepped up to help members in the community with the annual 10,000 Tonight food drive. This year’s organizers had to adapt during the campaign as COIVD-19 public health orders changed. (Black Press Media file photo)
West Shore students step up to make sure community members don’t go without

Students of SD62 are this year’s recipient of the Youth Volunteer Award

A cat died in this house fire in Sidney afternoon. The fire started on the house’s deck and spread from that point. Sidney Volunteer Fire Department Chief Brett Mikkelsen said the permanent presence of crews at the Community Safety Building prevented worse damage. (Photo courtesy of Clayton Firth)
Sidney house fire kills cat, causes extensive damage

Official says fire started on deck and damage to the house could have been worse

Millstream Village is welcoming a new Marshalls location March 9. (Photo courtesy GWL Realty Advisors)
New Marshalls store in Langford brings boost to women in need

Retailer will hold opening ceremony in Millstream Village March 9

Abstract Developments is donating $75,000 to support community programming at The Cridge Centre for the Family. (Courtesy of The Cridge Centre)
Victoria developer builds support for community programs

Abstract Developments donates $75,000 to The Cridge Centre for the Family

SD 62 (Sooke) has announced a COVID-19 exposure at David Cameron Elementary in Colwood. Potential exposure dates are Monday, Feb. 22; Tuesday, Feb. 23; and Wednesday, Feb. 24. (Black Press Media File).
COVID-19 exposure at Colwood’s David Cameron Elementary

Potential exposure dates are Monday, Feb. 22; Tuesday, Feb. 23; and Wednesday, Feb. 24.

A health worker holds a vial of AstraZeneca vaccine to be administered to members of the police at a COVID-19 vaccination center in Mainz, Germany, Thursday, Feb. 25, 2021. The federal state of Rhineland-Palatinate, start with the vaccination of police officers in internal police vaccination centers. (Andreas Arnold/dpa via AP)
B.C. officials to unveil new details of COVID vaccination plan Monday

Seniors and health-care workers who haven’t gotten their shot are next on the list

A boat caught fire in Ladysmith Harbour on Saturday morning. (Photo submitted)
Search underway for missing woman after boat catches fire in Ladysmith harbour

A large boat caught fire on the morning of Saturday, Feb. 27

Lone orca from a pod that made its way north from Georgia Strait and into Discovery Passage on Saturday, Feb. 27, 2021. Photo by Ella Smiley/<a href="https://www.facebook.com/Comoxvalleywildlifesightings/?ref=page_internal" target="_blank">Comox Valley Wildlife Sightings </a>
Island wildlife viewers thrilled by close view of passing Orca pod

Group gives wildlife photographers a classic opportunity to view them off Campbell River shoreline

An investigation is underway after a man was shot and killed by Tofino RCMP in Opitsaht. (Black Press Media file photo)
Man shot and killed by RCMP near Tofino, police watchdog investigating

Investigation underway by Independent Investigations Office of British Columbia.

B.C. Supreme Court in Vancouver on Tuesday December 11, 2018. THE CANADIAN PRESS/Darryl Dyck
B.C.’s compromise on in-person worship at three churches called ‘absolutely unacceptable’

Would allow outdoor services of 25 or less by Langley, Abbotsford and Chilliwack churches

Baldy Mountain Resort was shut down on Saturday after a fatal workplace accident. (Baldy Mountain picture)
Jasmine and Gwen Donaldson are part of the CAT team working to reduce stigma for marginalized groups in Campbell River. Photo by Marc Kitteringham, Campbell River Mirror
Jasmine’s story: Stigma can be the hardest hurdle for those overcoming addiction

Recovering B.C. addict says welcome, connection and community key for rebuilding after drug habit

A Vancouver restaurant owner was found guilty of violating B.C.’s Human Rights Code by discriminating against customers on the basis of their race. (Pixabay)
Vancouver restaurant owner ordered to pay $4,000 to customers after racist remark

Referring to patrons as ‘you Arabs’ constitutes discrimination under B.C.’s Human Rights Code, ruling deems

Most Read