A resident of Whitehorse, YT found a USB drive in a pawn shop which contains confidential case files from the Yukon government’s Health and Social Services department.
"I spotted some USBs, like a wicker basket just with loose USBs. There's roughly five or six USBs just sitting there," Brian Zink, the man who uncovered the files last week, told CBC News.
When Zink realized there were files saved on the drive, and what the files meant, he turned it over to the Department of Health and Social Services and informed the territory’s information and privacy commissioner.
CBC News assessed the files to confirm their authenticity before the drive was wiped. The outlet reported that the data included confidential case files from the health agency’s family and children's services branch, such as case assessments, reports, budgets, and personal contact information.
The Yukon government announced shortly after the files were uncovered that it was made aware of the breach. The territorial information and privacy commissioner's office also issued a statement following the news, saying that the government is required to investigate any alleged privacy breach and find out if any residents are "at risk of significant harm."
"Where a department identifies a risk of significant harm, this triggers a requirement to notify affected individuals, and to provide our office with a breach report outlining what actions they took to mitigate the breach and avoid a recurrence," the commissioner’s statement read.
This week, Health Minister Tracy-Anne McPhee confirmed the files were indeed from the family and children's services branch of the Health and Social Services department, and that the drive is now "safely in [the department’s] possession.”
McPhee also said that the files were removed from the department’s system by a former employee, who had “abandoned” their belongings in a storage unit. From there, the USB drive was sold to a local pawn shop. The health minister added that the former employee was not authorized to have taken this information.
Between 30 and 60 people are potentially affected by the data breach, McPhee said, but she also warned that it is not the final number, as work continues to identify all those who may be impacted. The minister gave assurances that the department will notify all those affected by registered mail by the end of the week.
"On behalf of the Government of Yukon, I offer my sincere apologies to those impacted by this privacy breach," said McPhee in a statement. "Ensuring that Yukoners' personal information is protected and secure is of the utmost importance and we are taking this situation very seriously."
Investigations into the breach are being conducted by the government, the territorial privacy commissioner and RCMP, reported CBC News.
