SLGA sends businesses 1st direct warning credit card data may have been stolen, almost 3 months after hack
CBC
On Monday, the Saskatchewan Liquor and Gaming Authority (SLGA) emailed some of its business partners, alerting them their credit card data may have been stolen during a Christmas Day hack of the organization's computer systems.
Mark Heise, who runs Regina's Rebellion Brewing Company, is one of those who received that email. He said the three-and-a-half month delay in notification points to the organization's "lack of urgency" and "lack of concern" about the breach.
He said it's not just the hack of the credit card data that alarms him.
"It's any information. There's trade secret information... There's sales data," he said. "All of that stuff is valuable to your competitors or whomever.
"We were not advised of that by our own government. That's pretty concerning to me."
Last week, CBC reported that the hackers had provided a series of what appeared to be confidential SLGA documents. Among those records was credit card information belonging to some SLGA suppliers.
In an SLGA email provided to CBC, the Crown corporation wrote that following CBC's report, "SLGA immediately launched a further investigation. It determined credit card information belonging to some retail store permittees and craft suppliers was stored on SLGA's network."
"As a result, your credit card information may have been accessed or taken."
Heise, who is also president of the Saskatchewan Craft Brewers Association, said that while he's received great service from many SLGA employees, the delay in notification is unacceptable.
"I don't think that that would fit the criteria of an acceptable timeline by anyone's definition," he said.
About three weeks after the hack, SLGA warned its employees that their personal data may have been stolen. The organization offered them credit monitoring services.
But at that time, it didn't warn any of its business partners, suppliers, vendors or licensees.
Then on March 22, three months after the hack, SLGA posted an "indirect notification" on its website that a wide range of data belonging to gaming, liquor and marijuana permittees may have been stolen by the hackers. SLGA said that may include medical, criminal, financial and personal data.
But in the Monday email to its business partners, SLGA said it wasn't until an investigation, prompted by CBC's report, that the organization discovered credit card data was at risk.