City reports security breach of website

Potential risk of unauthorized access to residents' information

City reports security breach of website

The City of Abbotsford website may have been breached, according to a notice issued by the city.

On July 16, the city found that software used to run web services may have been accessed without authoritzation. The city then shut down all external access to online services in order to protect data.

The city hired an independent  security consultant who worked with business technology staff to assess the breach.

City staff and the consultant confirmed that though there was unauthoritzed access to the site, there is no evidence that any data was accessed.

“This is purely a precautionary measure to tell people that this happened… We don’t believe any information was actually accessed,” said city clerk Bill Flitton.

The data that was potentionally at risk includes information provided by residents who participate in the property tax pre-payment plan and pre-paying taxes through automatic withdrawal. That information would be the kind commonly found on personal cheques, such as name, address and the bank account number.

For customers who use MyCity Online services, account information, passwords and security questions were at risk.

Also at risk was property tax and utility billing data, property ownership, homeowner grants, dog licence information and bylaw information and complaints.

The city stated the data would not contain credit or debit card information, social insurance numbers or driver’s licence data.

Flitton said that residents who use MyCity Online services may wish to change their passwords and security questions.

The city doesn’t know who gained access to the site.

Flitton said the unauthorized access may have been prompted by companies seeking contact information in order to send “phishing emails.”

“We believe that’s what was happening here based on the type of information they were trying to access.”

The issue has been addressed and as of Tuesday online services were restored.

Flitton said though the breach will likely not impact people, the city issued the notice for transparency.

A similar incident occurred in Maple Ridge this month. On July 2, the District of Maple Ridge’s computer system was breached, but was not detected until July 21. The city believes the breach was done by third-party software installed onto the district’s server. The district has also notified users, but believes that no data was accessed during the breach. City staff have also recommended that users of the My Maple Ridge online services change their security questions and passwords.

The City of Abbotsford has sent emails and letters to the public informing them of the breach. For more information, email privacy@abbotsford.ca, call 604-851-4197 or visit the city’s website at abbotsford.ca.