The personal information of about 37,000 Canadians held by TransUnion may have been compromised this past summer, leaving both of Canada’s credit monitoring agencies with data blemishes on their record.
The TransUnion incident is much more limited than the high-profile data hack at credit monitoring agency Equifax Inc. in 2017, which exposed the information of 147 million people, including about 19,000 Canadians.
TransUnion said in a statement Wednesday that someone fraudulently accessed its data through the use of one of its business customer’s login credentials between June and July.
Company spokesperson David Blumberg said that while the investigation is ongoing, the company maintains that the fraudulent login was not a failure of its systems.
“The unauthorized access was not the result of a breach or failure of TransUnion’s systems or our customer’s system,” he said.
Canadian Western Bank (CWB) confirmed that the credit report data was accessed through an account at its leasing division.
“In August, we learned that CWB National Leasing’s account was illegally used by an unauthorized third party to perform unauthorized credit checks,” said company spokesperson Maya Filipovic.
She said no personal information held by CWB National Leasing was taken, disclosed or misused in any way.
Type of personal information accessed
TransUnion did not disclose what kind of personal information was compromised by the fraudulent login.
A credit check by a bank or lender could give access to an individual’s name, date of birth, current and former addresses, information on existing credit and loan obligations, credit repayment history and potentially their social insurance number.
TransUnion said it learned of the breach in August and has notified those whose information may have been accessed as well as the privacy commissioners.
The incident is the latest of numerous data breaches in recent years, including the Equifax breach. More recently, Capital One said in July that data of six million Canadians was hacked, including about a million social insurance numbers. Desjardins said in June that the data of about 2.7 million accounts was hit with a breach.
The problem is that no system is foolproof, said Hasan Cavusoglu, an associate professor of management information systems at the UBC Sauder School of Business.
“The reality is this is a moving target. Organizations are every day exposed to new type of attack vectors, new kinds of threat actors.”
He said customers have little choice but to have their data held with TransUnion and Equifax.
“As long as you do some kind of transaction, your data will inevitably fall into these companies.”
The two credit monitoring agencies collect a variety of financial data to help banks and other lenders figure out how reliably a customer might pay them back. The model means the agencies want to collect as much information as possible to clearly represent someone’s creditworthiness, said Cavusoglu.
While breaches are impossible to rule out entirely, major financial institutions like credit agencies have significant incentives to keep the data safe, he said.
“Reputational damage as a result of these kinds of attacks is tremendous, let alone another kind of maybe regulatory sort of penalties as well as some legal costs associated with it. So they don’t want that reputational damage.”
Chicago-based TransUnion continues to look for ways to strengthen its defenses against unauthorized access of any kind, and supports customers in efforts to protect their data, Blumberg said.
Leave a comment