Justice Institute employee sues ICBC for privacy breach that allegedly led to her vehicle torched, bullets fired at home

[Erica Absetz <erica () riskbasedsecurity com>]

http://metronews.ca/news/vancouver/639835/justice-institute-employee-sues-icbc-for-privacy-breach-that-allegedly-led-to-her-vehicle-torched-bullets-fired-at-home/

A Justice Institute employee is suing the Insurance Corp. of B.C.,
alleging an ICBC clerk accessed personal information that led to her
husband’s van being torched and bullets fired at her home.

The suit is tied to a mystery involving the training academy in New
Westminster for police, sheriffs and firefighters. RCMP said in
September 2011 they were investigating threats and criminal activity
perpetrated against a number of people linked to the institute.

No charges have been laid.

Annette Oliver alleges in her lawsuit that her husband’s van was
torched on April 17, 2011, at about 2 a.m., which police believe was
an arson.

Then on June 1, 2011, Oliver claims, she was at home when she heard
three loud bangs at about 5 a.m. and discovered three bullet holes in
the front of her house.

Oliver says her husband and two daughters were home at the time.

“The plaintiff alleges these attacks were perpetrated by John Doe(s)
with the intent to terrorize and intimidate the victims and their
families,” says the lawsuit, filed this week in B.C. Supreme Court.

“The plaintiff alleges that John Doe was aided and abetted by Jane
Doe, who had access to the plaintiff’s personal and private records
that were in control and possession of ICBC.”

Oliver claims ICBC is vicariously liable for its employee, Jane Doe,
who unlawfully accessed Oliver’s personal information stored in ICBC
databases.

In September 2011, RCMP said 10 people had been targeted with fires
set at their homes and some had their homes shot up.

Three months later, on Dec. 14, 2011, the RCMP revealed the
investigation had found a link to an ICBC employee, who allegedly
accessed personal information of 65 people, including 13 identified as
victims who were targeted.

ICBC said at the time the employee under investigation was a woman who
had been at ICBC for 15 years before she was fired in August 2011.

The legal action quotes ICBC President Jon Schubert as saying in
December 2011: “We are appalled that one of our employees
inappropriately accessed the information of so many customers without
any apparent business reason to do so. Our main concern is for the
customers who have suffered as a result of this privacy breach.”

Last September, police announced that another arson at a West
Vancouver home was linked to the ICBC/Justice Institute investigation,
increasing the total to 14 victims.

The lawsuit names as a defendant Jane Doe, indicating a person whose
identity has not been made public, as the former ICBC clerk who
accessed ICBC records, and John Doe as the person who carried out the
“acts of terrorism and intimidation.”

The lawsuit alleges ICBC was negligent in failing to conduct
background security checks on prospective employees, failed to conduct
security audits to prevent unauthorized access to confidential
personal information and failed to ensure clients’ personal
information remained private.

It also alleges breach of contract by ICBC, a public insurance company
that makes in mandatory for B.C. residents to disclose personal
information in order to obtain a driver’s licence or insure a vehicle.
_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges.