Breach Reference
Scan your email →
Data breach reference · April 2018

Were you affected by the Nova Scotia Freedom of Information Portal breach?

Disclosed
Apr 5, 2018
Records affected
7,000
Type
Access control failure
Sector
Government / Public Sector

Check if your email appears in this breach.

One-click check against public breach records. No account required.

Takes 60 seconds. We never store your email address.

What happened

In April 2018, a Nova Scotia government freedom-of-information portal was found to expose thousands of documents to unauthorized users via URL enumeration. Personal information including names, addresses, and government file details was accessible.<br><br>A 19-year-old who discovered the flaw and downloaded the exposed documents was initially charged with unauthorized use of a computer. Charges were later withdrawn amid public criticism, and the incident became a reference case for insecure-direct-object-reference vulnerabilities in Canadian government systems.

In April 2018, a Nova Scotia government freedom-of-information portal was found to expose thousands of documents to unauthorized users via URL enumeration. Personal information including names, addresses, and government file details was accessible.

A 19-year-old who discovered the flaw and downloaded the exposed documents was initially charged with unauthorized use of a computer. Charges were later withdrawn amid public criticism, and the incident became a reference case for insecure-direct-object-reference vulnerabilities in Canadian government systems.

Reported impact: Charges later withdrawn

Source: OIPC Nova Scotia

What to do if you were affected

Common questions about the Nova Scotia Freedom of Information Portal breach

When did the Nova Scotia Freedom of Information Portal breach happen?
The breach was disclosed in April 2018. Public reporting was carried by OIPC Nova Scotia. The incident is categorized as: Access control failure.
How many people were affected?
Approximately 7000 records were reported affected. Whether your specific data was among them depends on your relationship with Nova Scotia Freedom of Information Portal during the exposure window.
How do I check if my email was in this breach?
Enter your email in the scan form above. LeakTrace runs a check against known breach records and returns the result in under a minute. No account required.
What should I do if my data was exposed?
• If you submitted a freedom-of-information request to the Nova Scotia government before April 2018, review the content of that request for sensitive information.
• Monitor for unusual activity referencing government correspondence.
• Enable two-factor authentication on all government-related online accounts.
Is my data still at risk years later?
Yes. Breach data from years past continues to circulate on active infostealer channels and credential-stuffing marketplaces. The passage of time does not neutralize the exposure. Ongoing monitoring catches new exposures as they land instead of only the ones already disclosed publicly.