Over the last month, my wife and I have been doing shopping at Ikea Canada. But I may be rethinking that as it has come to light this past week that Ikea Canada had what they term an “Internal” data breach that affected 95,000 Canadians. Global News has the details:
Ikea Canada told Global News it was made aware that some of its customers’ personal information appeared in the results of a generic search made by an employee between March 1 to March 3.
A spokesperson added that the information was accessed by the person using Ikea’s customer database.
“While we can’t speculate as to why the search was made, we can share that we have taken actions to remedy this situation,” Ikea Canada PR leader Kristin Newbigging said.
“We have also reviewed our internal processes and reminded our co-workers of their obligation to protect customer information.”
Okay. The fact that you have to remind your employees not to do something like this is a huge problem. And the fact that an employee did this is a massive problem. It likely shows that their internal controls weren’t on point.
Here’s the best news out of this:
kea Canada has submitted a breach report to the Office of the Privacy Commissioner of Canada (OPC).
OPC officials confirmed they are in communication with the company to get more information and determine next steps. They would not say what those steps could be.
Hopefully the OPC smacks Ikea Canada silly as this is pretty unacceptable from my perspective. In the meantime, affected customers have already been notified by email.
The IT Nerd 
India Orders VPN Providers To Retain Data…. VPN Providers Are Considering Their Options Including Leaving The Country
Posted in Commentary with tags India, Privacy on May 9, 2022 by itnerdIndia has ordered VPN’s to collect and store users’ data, including names, addresses, contact numbers, email and IP addresses, for up to five year. With this move, Wired reported that VPN providers have since threated to quit India:
The justification from the country’s Computer Emergency Response Team (CERT-In) is that it needs to be able to investigate potential cybercrime. But that doesn’t wash with VPN providers, some of whom have said they may ignore the demands. “This latest move by the Indian government to require VPN companies to hand over user personal data represents a worrying attempt to infringe on the digital rights of its citizens,” says Harold Li, vice president of ExpressVPN. He adds that the company would never log user information or activity and that it will adjust its “operations and infrastructure to preserve this principle if and when necessary.”
Artur Kane, CMO at GoodAccess had this to say:
“Though controversial upon inception, the so-called data retention legislation has now been with us for decades. Most technologically developed countries enforce these directives with varying retention periods, usually ranging from 6 months to 2 years. In some countries, all expenses on data retention are even covered by the government.
Until now, the data retention obligations were limited to infrastructure providers (internet service providers, telecommunications), and asking the same of VPN vendors is without precedent in democratic countries.
The use of VPNs, in the past widely adopted by companies to provide remote access to company IT resources, has rapidly spread to millions of consumers over the past decade, who use it to avoid surveillance by internet providers, bypass country-based content filtering, and other restrictions. In my opinion, cybercriminals had been using VPNs to anonymize their activities even before ordinary users jumped on the trend.
Now, forcing VPN providers to track user traffic and their private data (like source and destination IP, port, protocol, and timestamps) is going to invalidate one of the last remaining safeguards of personal privacy on the public internet while helping to expose only a handful of lawbreakers.
The value for the price doesn’t add up, either. Privacy is a basic human need, legally protected in many free countries, and people have the right to protect it, especially now, when their sensitive data is more valuable than ever and is being collected on a shocking scale.
Law on the public internet can be enforced in other ways that do not impact user privacy, such as the use of behavioral algorithms by vendors, looking for characteristic patterns of potentially malicious behaviors, or disabling VPN services to those accounts where such events were detected.”
I have been to India a number of times and this news is very disappointing. India really needs to reconsider this as this is a massive overreach by the Indian Government. And it risks making them a very repressive country that nobody will want to visit or do business in.
1 Comment »