About 40,000 people were affected by SLGA cyberattacks, according to the Privacy Commissioner

walterpalladNovember 25, 2022

This attack was caused by software vulnerabilities, undetected attacker activity, and unnecessary information retention by SLGA.

The personal information of approximately 40,000 people was compromised, including current and former employees, employee dependents, and regulatory customers. Photo by Gord Waldner /star phoenix

A cyberattack targeting Saskatchewan’s Liquor and Gambling Authority compromised the personal data of about 40,000 people, according to a report from the state’s Information and Privacy Commission.

SLGA issued a media release on December 28, 2021, informing the public that the attack took place three days ago.

However, Commissioner Ron Kruzeniski reported on November 10 that the attack actually took place in November, when an IT employee was unable to connect to a web server and the attackers sent a ransom demand on Christmas Day. Said it was detected only on days.

Kruzeniski found that SLGA took appropriate steps to contain the privacy violation once the attack was discovered.

Software vulnerabilities, undetected attacker activity, and “unnecessary retention” of personal information by SLGA are the three root causes of attacks, the report said.

The data of approximately 40,000 individuals were affected, including current and former employees, employee dependents, and regulatory clients.

Attackers threatened to share the data with the media and the dark web. Since March 22, 2022, SLGA has learned that personal information has been exposed to the dark web.

According to the report, a vulnerability in Crown’s content management system platform allowed the attackers to remotely infiltrate SLGA’s IT environment without authentication.

SLGA said it was unaware of the vulnerability because it had not been informed of it by its platform supplier.

However, Kruzeniski pointed out that the vendor posted a security bulletin on its website on October 8th explaining the vulnerability and how to fix it. Articles and blogs were then published further promoting that information.

It took 78 days from the vendor posting the bulletin to SLGA discovering the attack.

The attacker’s intrusion into the IT environment was also not detected as unusual or malicious. In the window before SLGA knew about the attack, the attacker had access to multiple data areas.

Kruzeniski said this was exacerbated by the “unnecessary retention” of personal information by state-owned enterprises, including former employees and their dependents, as well as regulated customers whom SLGA had not been in contact with in the past five years. Stated.

“If SLGA had not retained personal information indefinitely, the number of affected individuals could have been much lower,” he said.

Kruzeniski made many recommendations for next steps for SLGA. To prevent missing information about potential vulnerabilities, SLGA should subscribe to security bulletins emailed by content management system vendors, he said.

In addition, Crown Corporation must regularly evaluate its systems for detecting and blocking malicious activity and modify its policies regarding the retention of personal information to avoid doing so unnecessarily.

Kruzeniski also posted details on its website outlining how affected persons can request copies of lost information, as well as information on regular communication with employees and clients. recommended to do so.

News always seems to fly fast to us. From the latest on COVID-19, to politics and crime and everything in between, it can be hard to keep up.With that in mind, Saskatoon Star Phoenix is afternoon headlines A newsletter is delivered daily to your inbox to help you stay up to date with the most important news of the day. Click here to subscribe.