Incident case summary #2017-001: Multiple breach incidents as a result of password reuse
This report details three incidents in 2017 where Canadian organizations experienced data breaches due to password reuse by their customers. In each case, attackers used login credentials obtained from unrelated breaches to access customer accounts. The Office of the Privacy Commissioner of Canada found the organizations' responses to be appropriate, including actions like password resets, enhanced security measures, and customer notifications, and encouraged other organizations to adopt similar preventative strategies.
- Impact of password reuse on personal information security
- Adequacy of organizational responses to data breaches
- Effectiveness of safeguards against unauthorized access
- Communication and notification obligations to individuals
The Office of the Privacy Commissioner of Canada was satisfied with the organizations' responses and implemented safeguards.
Each organization took appropriate steps to mitigate risks to individuals and prevent recurrence of similar incidents, demonstrating positive actions to address the breaches.
AI-generated summary for reference only. Always verify against the official decision ↗
The report encourages organizations to implement processes to prevent unauthorized access to customer accounts resulting from password reuse.
This summary is informational only and not legal advice.