Data lost on 583,000 Canada student loan borrowers -

Data lost on 583,000 Canada student loan borrowers

Names, SIN numbers, contact info. missing


Minister Diane Finley (pictured) called the incident "unacceptable and avoidable." (Patrick Doyle/CP)

A federal agency has lost a portable hard drive containing personal information about more than half a million people who took out student loans.

Human Resources and Skills Development Canada said Friday the device contained data on 583,000 Canada Student Loans Program borrowers from 2000 to 2006.

The missing files include student names, social insurance numbers, dates of birth, contact information and loan balances of borrowers, as well as the personal contact information of 250 department employees.

Borrowers from Quebec, Nunavut and the Northwest Territories during this time period are not affected.

No banking or medical information was on the portable device.

Human Resources Minister Diane Finley said she has called on the RCMP to assist with the incident, “given its serious nature.”

“I want all Canadians to know that I have expressed my disappointment to departmental officials at this unacceptable and avoidable incident in handling Canadians’ personal information,” she said in a statement.

In addition, the office of the federal privacy commissioner announced Friday it would investigate.

The department is sending letters to affected people, for whom it has current contact information, to advise them on how to protect their personal information.

A toll-free number has been set-up at 1-866-885-1866 (or 1-416-572-1113 for those outside of North America) for individuals to determine if they are affected.

The loss of the hard drive from an office in Gatineau, Que., came to light as the department looked into another breach — a missing USB key containing the personal information of more than 5,000 Canadians.

The privacy commissioner’s office has already begun a probe of that incident, which was publicized last month.

Human Resources says that while there is no evidence any of the information in the latest breach has been used for fraudulent purposes, an extensive search for the hard drive continues.

In her statement, Finley said she had directed officials to take immediate action to ensure “that such an unnecessary situation” does not happen again.

She has requested that departmental employees across Canada receive information about “the seriousness of these recent incidents” and that they participate in mandatory training on a new security policy.

The new policy immediately bans portable hard drives within the department. In addition, unapproved USB keys are not to be connected to the computer network.

All portable security devices will be assessed for the risk they pose, to ensure that appropriate safeguards are in place.

New data-loss prevention technology — which can control or prevent the transfer of sensitive information — will also be introduced.

Finally, staff will be subject to disciplinary measures, including possible firing, should privacy and security codes not be followed.

Alyson Queen, a spokeswoman for the minister, said the Mounties were contacted Monday. “They will determine what further steps are required.”

—Jim Bronskill


Data lost on 583,000 Canada student loan borrowers

  1. Please don’t tell us you care- we don’t beleive you for a second MS. Finley

  2. My big question would be,,,,,,,what are the powers at be going to do about this breech of confidentiality, saying it won’t happen again doesn’t help those affected now!

  3. $195,188,400 is what this avoidable mistake will cost the government (taxpayers) at the least. $13.95 per month for Equifax to monitor your credit for 2 years at the least x 583,000 people. Can you say class-action lawsuit. Diane Finley is underestimating how serious this privacy breach is – since she is the Dept head the buck stops with her, since she did not ensure proper procedures were in place a resignation is in order.

    • 2 years monitoring is not enough!! Someone could sit on this information for 10+ years and then use it. I have been affected and I am looking for compensation. It is not fair to myself and other people affected to have to watch out for fraud for the rest of our lives.

      • I am also affected. I was told when I called that I could sign up for these services out of my own pocket!!

      • I just found out I am affected too… Mine have been paid off, yet my personal info is out there.. wtf.. I have to pay out of my own pocket to monitor my credit???

  4. This is totally unacceptable and absolutely irresponsible. My daughter and many others I know unfortunately are on this list…absolutely ridiculous! Now are you going to give all of these people new social insurance numbers or how will this be rectified? My daughter and her husband were both told sorry…it NEEDS to be rectified NOW!!

  5. Why is it so hard to run Full Disk Encryption (FDE)? If you have a laptop, a USB key, a portable harddrive then there is only one thing to do. Encrypt it.

    Google “True crypt”.

    It’s fast and free.

  6. Those who are affected…could we file a civil lawsuit?

  7. i think the gov’t should pay off loans or good portion of them for those that are affected. I am not sure yet if i am on the list but will be calling soon.

  8. I just found out I am affected. I have to admit this has me rattled. I have read that you should also have TransUnion also monitor your credit since not all banks use Equifax (sister is a banker). So that’s $30/month for years…

    I have found a class action website based out of St. John’s NFLD.

    • Hi Becky! Unfortunately I am affected too… do you happen to have the url on hand regarding the class action website??? Thanks :)

  9. I just called the number and it says its Credit Card Services?!?!?!?

  10. Why is our personal information kept on USB keys and portable hard drives? This is the most unprofessional thing to do when you hold people’s information. What were you thinking? Don’t you have any security protocol in your building?

  11. I too have been affected….I dealt with a huge bitch on the phone when after I verified myself I asked
    “what address do you have on file?” to which she replied
    “I cant give you that information” ……
    Anyone else see a problem here..Their is currently a lawsuit in play everyone affected sign up at

    • Do you really want them to give out your information on the phone though? Especially after losing your info on a USB key?

  12. I think it’s funny that people are suggesting that their student loands are waived over this. Do the math here, Folks. The average Canadian student loan is $5,226 (although I personally borrowed 75K for a graduate degree!):

    If you think that the goverment is going to just excuse 3 BILLION dollars in student loans because someone swiped an unencrypted external USB drive off a shelf, you’re more ignorant to the reality of this situation than Diane Finley is.

    Your data is probably in the hands of a criminal group by now, and you’ll be paying back your student loan nonetheless, and that’s all there is to it. Protect yourself from fraud the best you can and move on.

    The least the government could do at this time is generate the 583,000 borrowers who were affected a new SIN number, and possible make a bulk deal with the credit bureaus on a government paid “protection” package that most of them offer for a monthly fee otherwise. Again, we’re talking the Canadian government here, I wouldn’t hold your breath on that, or anything for that matter.

    And if anyone here isn’t fully convinced that this was a totally planned and perfectly executed criminal act, remember that Quebec is the worst province in Canada for identity theft and bank scams, and “coincidentally” data from Quebec was not on that drive. Give me a break – we’re not idiots.

    Ready yourselves for the worst and move on.

  13. You have go to be kidding me! Even the people on the phone are acting like this is no big deal. YOU HAVE MY SIN #!!!!!!

  14. The LEAST which could be done to rectify this issue would be to forgive any owing loans for anyone affected.

  15. This is TOTALLY unacceptable!!! Not only was my family affected by the loss of my 50 year old mother with her passing from Breast Cancer MUCH TO EARLY IN HER LIFE because of the Cameron Report, now I have been affected by this!!!! I will be registering for the law suit. National Student Loans Service Center do absolutely NOTHING to help students who are ROBBED monthly and will NEVER get out of this debt! If we only knew how difficult it would be to gain a job once graduated, we most likely NEVER would have received these loans! INCOMPETENCE IS SAYING IT LIGHTLY!!!!!!!!!!!!!!

  16. Did they at the same time happen to lose how much we owe ?….of course not, that would never happen !

  17. ‘In her statement, Finley said she had directed officials to take immediate action to ensure “that such an unnecessary situation” does not happen again.

    She has requested that departmental employees across Canada receive information about “the seriousness of these recent incidents” and that they participate in mandatory training on a new security policy.’
    Uhmmmm…this is a concept that they’ve only stumbled onto now?

    I’m tired with reading this nonsense every time something serious comes along. It sounds like staffers will once again have to cringe at the thought of another meaningless lecture.
    How about something simple that everyone can understand- along the lines of ‘you’re fired if you conduct any business in such a manner that any mishandling of any information has even the potential to be harmful. That you got lucky this time and nothing went awry, it could have. Too bad, so sad, not good enough. Personnel has your final cheque.’

  18. Same here apparently my loan is fine oh but sorry we lost your personal information with which another person could use to create a whole new Id set. Plus get credit cards, house, and who wil end up getting the brunt of it? Me? And what’s going t happen then? I’ll have to deal with all of these claiming fraud but my credit report will still be affected. And it’s my responsibility to always check my credit report to make sure nothing is weird for the rest of my life. That’s bullshit.

  19. Oh that’s just great. The government left a ‘toy rattle’ in the hands of a 2 year old – – AGAIN. I somehow don’t think words of apologies are going to bring any sort of comfort or a sense of safety to the ones who are affected by the government’s irresponsibility and blunderness. And, I’m sure Ms. Finlay’s “call” to the RCMP means nothing more to her than like she’s ordering an ex-large pizza for the apes in her department! Nice going (sarcasm)!

  20. Pingback: Canadian Personal Trainers Insurance

  21. Pingback: Four Steps To Improve Your Nonprofit’s Digital Security

  22. Pingback: Thoughts on Email and Ethical Research – A Paramedic's Notebook