DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Information and Privacy Commissioner issues his decisions about the Epsilon data breach that affected Best Buy and Air Miles

Posted on May 20, 2011 by Dissent

From the press release:

The Information and Privacy Commissioner of Alberta, Frank Work issued his decisions today in regard to Best Buy Canada Ltd., and Air Miles Reward Program’s breach incident reports involving unauthorized
access to personal information.

Amendments to the Personal Information Protection Act (PIPA) require organizations to report incidents
where there exists a real risk of significant harm to an individual. The Act also empowers the Commissioner to require organizations to notify individuals to whom there is a real risk of significant harm as a result of such an incident. These ground breaking amendments to PIPA came into force on May 1, 2010 and are the first such law in Canada.

Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.

Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although
the information at issue (name, email addresses and organization membership (in the Best Buy case) was
relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.

The Commissioner stated that the number of affected individuals increases the likelihood that spear phishing attempts will be successful and significant harm to individuals could occur as a result of the breach.

The Commissioner stressed that breach report reporting and notification is an important step forward in
protecting personal information of Albertans and commends Best Buy and Air Miles in taking immediate
steps to notify affected individuals and to notify his Office of the incident. With that, he urges other
organizations affected by the Epsilon breach to immediately report the matter to his Office as required by
law.

What’s significant about this finding is that the Commissioner says that even (just) name and email addresses in the context of a large breach of this kind indicates a “real risk of significant harm.”

h/t, @bsbookman by way of @privacylawyer.


Related:

  • Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme Involving Telecommunications Companies
  • DOGE Denizen Marko Elez Leaked API Key for xAI
  • Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods
  • Texas Enacts Electronic Health Record Data Localization Law
  • United Australia Party confirms ransomware attack, personal data and email correspondence exposed
Category: Breach IncidentsBusiness SectorCommentaries and AnalysesNon-U.S.U.S.

Post navigation

← Hackers hit Sony sites raising more security issues
Texas governor signs law requiring sonogram before abortion →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • North Country Healthcare responds to Stormous’s claims of a breach
  • Gladney Adoption Center had serious data exposures in the past few months. What will they do to prevent more?
  • Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme Involving Telecommunications Companies
  • DOGE Denizen Marko Elez Leaked API Key for xAI
  • Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods
  • RansomedVC is back — and is still attacking its competitors
  • Texas Enacts Electronic Health Record Data Localization Law
  • United Australia Party confirms ransomware attack, personal data and email correspondence exposed
  • Armenian National Extradited to the United States Faces Federal Charges for Ransomware Extortion Conspiracy
  • 70% of healthcare cyberattacks result in delayed patient care, report finds

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Texas Enacts Electronic Health Record Data Localization Law
  • Upstate NY county clerk again refuses to enforce Texas abortion judgment
  • Attorney General James Leads Coalition Urging Congress to Protect Americans from Masked ICE Agents
  • Attorney General Tong Announces $85,000 Settlement with TicketNetwork for Violations of the Connecticut Data Privacy Act​
  • Fourth Circuit upholds West Virginia ban on abortion pills
  • Meta fixes bug that could leak users’ AI prompts and generated content
  • The EU’s Plan To Ban Private Messaging Could Have a Global Impact (Plus: What To Do About It)

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.