Up to 100K customers potentially affected by Bell data breach

BCE Inc. has reported a second data breach in less than twelve months, sending emails to customers Tuesday morning to inform them their information may have been compromised. According to cybersecurity expert Imran Ahmad, a partner at law firm Miller Thomson LLP, “it's like somebody breaking into your house for the first time... you may try to get a formal alarm system, better locks, so on and so forth.” But if it happens again, Ahmad said, “you really have to ask yourself that question: why am I being targeted?” Bell spokesman Marc Choma said in an email that "hackers illegally accessed some customer information, including name, email address and in some cases phone number, user name and/or account number, for a limited number of Bell customers.” He said “fewer than 100,000 customers” were affected by the breach. This followed an event in May 2017 where 1.9 million “active emails” were potentially compromised. Choma said the second breach was “unrelated” to the first. Bell said it was working with the RCMP and had notified the Office of the Privacy Commissioner of Canada (OPC) of the breach. OPC spokeswoman Tobi Cohen also confirmed to the Wire Report that it was informed of the security breach. Telecoms are perhaps more vulnerable to these kinds of attacks because of the type of information they hold on their customers, Ahmad told The Wire Report. Increasingly sensitive data needs more rigorous defences, he said. “I would put telcos, I would put banks, financial institutions, which have a lot of sensitive information... in a category where they should be and are required to have higher security safeguards,” said Ahmad. He also mentioned that it’s not just credit card data which can be leveraged by malicious actors. On the darknet, credit card information may be worth a dollar or two, Ahmad said. But more valuable “virtual profiles” of people, in which names, addresses, phone numbers are used in combination with date of birth and employer information to steal identities can be sold for “ten times” the amount of credit card info alone, Ahmad said. In a follow-up email, Ahmad indicated that it would be difficult to make a strong profile without date of birth or employer information, which were not included in the hack. However, he said hackers could use the account number in combination with other information to try to gain access to the account through a call centre, and after that, through a technique called social engineering (effectively stealing personal data without breaking technological security measures), a malicious actor can access other, outside services using details they glean with this sort of information. According to Ahmad, after Bell announced the breach in May, the company would have also had to outline how the breach happened to provincial and federal privacy commissioner offices. As well, the company would have had to demonstrate what they were going to do differently to make sure the event does not occur again. After today’s breach notification, any further information remains private under the Personal Information Protection and Electronic Documents Act (PIPEDA), said Cohen. That is, unless the commissioner decides to publish a report like it did in the case of Ruby Corp.’s Ashley Madison breach. At this time, Bell has not responded to emails questions as to whether it will offer credit protection services or increase risk mitigation strategies at its call centres. Today’s information breach is just another in a string of recent high profile events where sensitive data was potentially stolen. Breaches affecting Equifax Inc. and Uber Technologies Inc. have strained the federal privacy watchdog, which has stated it already operates with minimal resources. — With reporting by Bryson Masse at bmasse@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

Up to 100K customers potentially affected by Bell data breach

News | January 23, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Up to 100K customers potentially affected by Bell data breach

News | January 23, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC approves sale of 21 BC radio stations from Bell to Vista

Bell offering buyouts to up to 1,200 telecom employees, union questions cuts

Telecoms testing their networks for the future of quantum connectivity

Telus’ arguments for incumbent access to wholesale regime not supported by competitors

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us