Nova Scotia freedom of information website breached, personal information exposed

The government of Nova Scotia says the province’s freedom of information website was breached in March and the personal information of some people — including social insurance numbers, birth dates and personal addresses  — has been accessed.

The government says it is in the process of reaching out to people whose data may have been accessed and informing them of the breach. However, the province says that no financial information is at risk.

Questions about a possible data breach began circulating earlier this week after the government-run website was taken offline for more than a week due to “unscheduled maintenance.”

READ MORE: Nova Scotia won’t say why freedom of information website taken offline

On Wednesday, Nova Scotia’s Minister of Internal Affairs, Patricia Arab, apologized, saying she couldn’t inform media due to an ongoing investigation by Halifax Regional Police (HRP) into the breach.

“A breach is unacceptable. We will do better,” said Arab.

“HRP must do their job and we will do ours.”

The opposition parties swiftly shot back at the provincial government, criticizing them for what they say is unnecessary secrecy

“The Liberal government intentionally withheld information from the public about this data breach by refusing to answer journalists’ questions about this issue yesterday,” Dave Wilson, the NDP critic for internal services, said in a statement issued on Wednesday.

“Individuals whose personal information had been compromised should have been notified immediately.”

Notified of a data breach

The province says they were informed on April 5 by a provincial employee after they were able to inadvertently access documents through the portal.

This prompted the department of internal services to contact their third-party partner, Unisys, and take the website offline as they investigated.

On April 6, Unisys informed the province that between March 3 and March 5 more than 7,000 documents  were accessed and downloaded by a “non-authorized person.”

The province says that 250 of the documents contain highly sensitive personal information such as birth dates, addresses and social insurance numbers.

WATCH: Nova Scotia’s new FOIPOP website welcome but ‘systemic problems’ persist

The province’s freedom of information portal was developed to serve as a gateway to request documents and information under Nova Scotia’s freedom of information legislation.

Reporters, businesses, researchers and politicians are able to file requests with a $5 dollar application fee.

When they do so they receive an acknowledgment letter which normally includes information like the applicant’s name, personal address and email address. According to the province these were some of the documents accessed during the breach.

Decision letters as well as completed access to information requests were also reportedly accessed.

Multiple investigations underway

Nearly 24 hours later, the province informed Halifax police of the breach, who began their investigation.

Police say that on Wednesday morning, they executed a search warrant at an address in Halifax and took a person into custody.

HRP says the investigation ongoing and charges have yet to be laid.

Catherine Tully, the province’s privacy and information commissioner has also been informed of the breach, and is now launching her own investigation into whether the department of internal services was in compliance with province’s Freedom of Information and Protection of Privacy Act.

“The investigation will focus in particular on the adequacy of the security of the system,” wrote Tully in a press release.

People worried that their information may have been exposed they are encouraged to call 902-424-3843 or email askiapservices@novascotia.ca