Bob Mackin (Updated Feb. 27)
It’s official, hackers know where TransLink workers live.
A Feb. 22 memo to TransLink staff confirmed what had been suspected for the last two months: the restricted network drives accessed and copied by hackers contained social insurance numbers, birthdates, bank accounts and home addresses.
TransLink interim CEO Gigi Chen-Kuo
“TransLink recognizes the seriousness of the situation,” said the memo from interim CEO Gigi Chen-Kuo. “I want to reassure you that at this point TransLink is not aware of misuse of the personal information that was taken during this incident.”
In December, TransLink was slow to admit publicly that it had been targeted by ransomware cybercriminals, who took control of the company’s computer network and used TransLink’s own equipment to remotely print ransom notes that threatened to begin data publication within three days.
“Your network has been ATTACKED, your computers and servers were LOCKED, your private data was DOWNLOADED,” read the ransom note.
Chen-Kuo’s memo said TransLink is now reviewing its overall security and privacy protection requirements. All employees are offered two-year subscriptions to a TransUnion credit monitoring and fraud protection service.
On Jan. 6, lawyers in Vancouver and Toronto took the first step in a class action lawsuit against TransLink, on behalf of a former worker identified by the initials G.D.
The B.C. Supreme Court claim said the plaintiff is extremely concerned about the loss of his personal information and lack of meaningful communication on TransLink’s part.
TransLink’s Compass card (TransLink)
The hack was kept secret until news reports on Dec. 3, after the fare payment system broke down at SkyTrain stations.
It took until Dec. 30 for TransLink to confirm that social insurance and banking information had been compromised.
The claim, filed by Diamond and Diamond and KND Complex Litigation, claims TransLink violated its duty to safeguard information and violated workers’ privacy.
“TransLink‘s focus now is to help mitigate against future breaches of this nature and any potential misuse of your personal information,” Chen-Kuo wrote.
“In these types of incidents cyber criminals may try to profit from the personal information they steal through fraud or other means. These criminals aim to misrepresent you in order to obtain new credit or bank accounts under your name or use your identity to make purchases.”
In a Feb. 26 memo, Chen-Kuo revealed she’s among the victims.
“As a current employee, I received the same letter in the mail, advising that my social insurance number, date of birth, bank account number, and home address were unlawfully accessed,” said the memo, obtained by theBreaker.news. Chen-Kuo announced two, hour-long cyber incident information webcasts at 11:30 a.m. and 7 p.m.
“We will have experts on hand to help answer as many of your questions that you submit as time allows.”
Support theBreaker.news for as low as $2 a month on Patreon. Find out how. Click here.
