5 ms·

Quebec Ministry of Cybersecurity and Digital Technology employee data leaked

33 points by matbilodeau 3y ago

chrisweekly 3y ago
(nit) Title has typo, should be "Ministry"
- matbilodeau 3y ago
  thanks, I actually copy pasted the title (Minister of...) since I couldn't find the actual name in English on the govt. website.
matbilodeau 3y ago
Translation / TLDR Former HR employee (compensation) exfiltrated data to their personal email address. data included first and last name , SIN numbers of ministry employees. No evidence of wrongdoing yet but it raises questions of gross incompetence coming from the ministry in charge of preventing data loss.
- A4ET8a8uTh0 3y ago
  It is the old fashioned 'who guards the guards'. Eventually, someone does have access to all sorts of 'not good' things. Here, it is only surprising that it was HR.
  - piyh 3y ago
    Once we had a system that allowed notifications on employee changes, and an admin who ticked a fun box that resulted in everybody with an email on their employee profile getting notified in plaintext on SSN changes with before and after values. Many processes on the payroll vendor's side and our company were changed after that day.
- unforeseen9991 3y ago
  This is the Quebec government, it doesn't get any more grossly incompetent. The only question is what took so long
  - belval 3y ago
    > it doesn't get any more grossly incompetent Unless you are referring to tech in particular, that seems very harsh. The ministry of digital transformation is a shitshow, but the governement itself has not done anything that would warrant the label "grossly incompetent".
    - version_five 3y ago
      Um, healthcare, infrastructure... being completely absorbed in racism and anti Anglo hysteria, the GP comment is to nice if anything
    - jszymborski 3y ago
      I beg to disagree. It's hard to imagine handling the education and health portfolios worse than this provincial government has.
      - VancouverMan 3y ago
        It's easy to imagine for those who've lived in provinces under an NDP government.
      - aga98mtl 3y ago
        Quebec has the best life expectancy in the americas. It's PISA scores are above the canadian average, which is itself close to best in the whole world.
    - GinsengJar 3y ago
      The QC government isn't the worst, but their prospects have been scary for someone like me. I'd rather not be a second class citizen for being raised with the "wrong language".
    - 3y ago
- duxup 3y ago
  I worked for a company with a few thousand employees. HR had laptops with employee data on it stolen 3 times in two years. Each time they had left the laptop in their car after work when they went out to eat. That, among other things is my long sad experience with HR. It’s always some rando in a department / job where the rules don’t matter it seems.
  - dangerboysteve 3y ago
    Let me guess, also a non-encrypted disk ?
  - yowzadave 3y ago
    I believe HR is commonly targeted by attackers, precisely because they have access to sensitive personal information on their employees. I used to work at a company where a high-level HR employee received an email purporting to be from the CEO, asking for a list of all employees and SSN's. Rather than asking critical questions about this request, they simply collected the requested information into a spreadsheet and emailed it to the attacker. Presumably all of our information was subsequently sold to identity thieves.
    - nwoli 3y ago
      Seems more likely that it was just a random laptop theft rather than a targeted SSN capture
dang 3y ago
We love la belle langue but HN is an English language site so articles here need to be in English. If there's a suitable URL covering the same story, we can update it. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20la%20belle%20langue&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- matbilodeau 3y ago
  can't do much , didn't make English language news. Google translate seems to have problems with some news sites. Here's what Radio-Canada (french CBC) has to say https://ici.radio-canada.ca/nouvelle/2001279/incident-securite-informatique-ministere-cybersecurite-maitrise https://ici.radio-canada.ca/nouvelle/2001279/incident-securi... The Ministère de la Cybersécurité et du Numérique du Québec confirmed on Thursday that an incident of computer security due to an action by an employee was quickly corrected. This employee has been transferred to une boîte de courriel personale des documents contenant des renseignements personnels de 529 employés de la fonction publique. Elle aurait agi de bonne foi et a collaboré avec le ministère, a indicé ce dernier en réponse aux questions de Radio-Canada. The incident occurred on May 23 last year, when the employee was transferred to another public organization. She explained that she had transferred documents to be able to answer the questions of her replacement in order to facilitate the transition. The ministry specified that the employee had access to this information in the framework of his duties. Even if the intention of the employee was not to use the information for an illegal purpose, this practice contravenes the rules of safety in place intended for the personnel of MCN, the ministry emphasized in its email to Radio-Canada. Par ailleurs, the ministère indicated that a complaint had been filed with the police so that an inquiry could be opened. The employee was also sanctioned for not respecting the rules of the ministry, which ensured the destruction of the information transferred to the personal email box. The Information Access Commission was also informed of the incident.
ldehaan 3y ago
[dead]

33 points by matbilodeau 3y ago

chrisweekly 3y ago

(nit) Title has typo, should be "Ministry"

matbilodeau 3y ago
thanks, I actually copy pasted the title (Minister of...) since I couldn't find the actual name in English on the govt. website.

matbilodeau 3y ago

Translation / TLDR Former HR employee (compensation) exfiltrated data to their personal email address. data included first and last name , SIN numbers of ministry employees. No evidence of wrongdoing yet but it raises questions of gross incompetence coming from the ministry in charge of preventing data loss.

A4ET8a8uTh0 3y ago
It is the old fashioned 'who guards the guards'. Eventually, someone does have access to all sorts of 'not good' things. Here, it is only surprising that it was HR.
- piyh 3y ago
  Once we had a system that allowed notifications on employee changes, and an admin who ticked a fun box that resulted in everybody with an email on their employee profile getting notified in plaintext on SSN changes with before and after values. Many processes on the payroll vendor's side and our company were changed after that day.
unforeseen9991 3y ago
This is the Quebec government, it doesn't get any more grossly incompetent. The only question is what took so long
- belval 3y ago
  > it doesn't get any more grossly incompetent Unless you are referring to tech in particular, that seems very harsh. The ministry of digital transformation is a shitshow, but the governement itself has not done anything that would warrant the label "grossly incompetent".
  - version_five 3y ago
    Um, healthcare, infrastructure... being completely absorbed in racism and anti Anglo hysteria, the GP comment is to nice if anything
  - jszymborski 3y ago
    I beg to disagree. It's hard to imagine handling the education and health portfolios worse than this provincial government has.
    - VancouverMan 3y ago
      It's easy to imagine for those who've lived in provinces under an NDP government.
    - aga98mtl 3y ago
      Quebec has the best life expectancy in the americas. It's PISA scores are above the canadian average, which is itself close to best in the whole world.
  - GinsengJar 3y ago
    The QC government isn't the worst, but their prospects have been scary for someone like me. I'd rather not be a second class citizen for being raised with the "wrong language".
  - 3y ago
duxup 3y ago
I worked for a company with a few thousand employees. HR had laptops with employee data on it stolen 3 times in two years. Each time they had left the laptop in their car after work when they went out to eat. That, among other things is my long sad experience with HR. It’s always some rando in a department / job where the rules don’t matter it seems.
- dangerboysteve 3y ago
  Let me guess, also a non-encrypted disk ?
- yowzadave 3y ago
  I believe HR is commonly targeted by attackers, precisely because they have access to sensitive personal information on their employees. I used to work at a company where a high-level HR employee received an email purporting to be from the CEO, asking for a list of all employees and SSN's. Rather than asking critical questions about this request, they simply collected the requested information into a spreadsheet and emailed it to the attacker. Presumably all of our information was subsequently sold to identity thieves.
  - nwoli 3y ago
    Seems more likely that it was just a random laptop theft rather than a targeted SSN capture

dang 3y ago

We love la belle langue but HN is an English language site so articles here need to be in English. If there's a suitable URL covering the same story, we can update it. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20la%20belle%20langue&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

matbilodeau 3y ago
can't do much , didn't make English language news. Google translate seems to have problems with some news sites. Here's what Radio-Canada (french CBC) has to say https://ici.radio-canada.ca/nouvelle/2001279/incident-securite-informatique-ministere-cybersecurite-maitrise https://ici.radio-canada.ca/nouvelle/2001279/incident-securi... The Ministère de la Cybersécurité et du Numérique du Québec confirmed on Thursday that an incident of computer security due to an action by an employee was quickly corrected. This employee has been transferred to une boîte de courriel personale des documents contenant des renseignements personnels de 529 employés de la fonction publique. Elle aurait agi de bonne foi et a collaboré avec le ministère, a indicé ce dernier en réponse aux questions de Radio-Canada. The incident occurred on May 23 last year, when the employee was transferred to another public organization. She explained that she had transferred documents to be able to answer the questions of her replacement in order to facilitate the transition. The ministry specified that the employee had access to this information in the framework of his duties. Even if the intention of the employee was not to use the information for an illegal purpose, this practice contravenes the rules of safety in place intended for the personnel of MCN, the ministry emphasized in its email to Radio-Canada. Par ailleurs, the ministère indicated that a complaint had been filed with the police so that an inquiry could be opened. The employee was also sanctioned for not respecting the rules of the ministry, which ensured the destruction of the information transferred to the personal email box. The Information Access Commission was also informed of the incident.

ldehaan 3y ago

[dead]