What happened
In April 2018, a Nova Scotia government freedom-of-information portal was found to expose thousands of documents to unauthorized users via URL enumeration. Personal information including names, addresses, and government file details was accessible.
A 19-year-old who discovered the flaw and downloaded the exposed documents was initially charged with unauthorized use of a computer. Charges were later withdrawn amid public criticism, and the incident became a reference case for insecure-direct-object-reference vulnerabilities in Canadian government systems.
Reported impact: Charges later withdrawn
Source: OIPC Nova Scotia, 5 Apr 2018.
What to do if you were affected
- If you submitted a freedom-of-information request to the Nova Scotia government before April 2018, review the content of that request for sensitive information.
- Monitor for unusual activity referencing government correspondence.
- Enable two-factor authentication on all government-related online accounts.
Common questions
When was the Nova Scotia Freedom of Information Portal breach disclosed?
In April 2018. Public reporting was carried by OIPC Nova Scotia.
How many people were affected?
7,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Nova Scotia Freedom of Information Portal at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it and not reusing it, closes that door.
Is your address in a public breach? Check my address →