Personal info of 5,000 city employees compromised in data breach

The city says staff were notified on Wednesday that employee information was the subject of a data breach last year.

According to a written statement by Daryl Croft, branch manager of Open City and Technology (OCT), his branch discovered that records had been accessed by a former employee without authorization in May 2021.

“Earlier today, I notified City staff that private employee information was found within documents that were a part of a privacy breach that occurred within this organization. This is a regrettable situation, especially for anyone who may be affected by this,” the statement reads.

He claims the person uploaded the records onto their personal storage cloud account.

Croft says the breach was immediately reported to the city’s Corporate Access and Privacy Office, or CAP Office.

The breach was also reported to the Privacy Commissioner of Alberta.

Because of the size of the breach, an outside forensic IT consulting firm was hired.

The firm was able to identify more than 157,000 records that could belong to the city.

Croft said the city has no reason to believe the records were shared beyond the employee, who is no longer with the City of Edmonton, adding that the CAP Office has spent months reviewing records to identify which employees personal records may have been compromised.

The investigation revealed that private information of more than 5,000 employees was part of the breach.

Some of the information in the files included employee names, payroll numbers, performance management information, seniority lists, and recall information for employees who were temporarily laid off.

The statement says OCT has strengthened its processes to reduce the possibility of a similar breach in the future, and employees with concerns about their personal information are invited to contact the CAP Office with questions or concerns, including whether their information was included in the breach.