P2015-ND-31

An employee of the Organization distributed employee benefit information by email to 12 employees in Canada. However, the information of all 12 employees was inadvertently sent to each employee (as opposed to each employee receiving only his or her own information). The information was contained in an Excel spreadsheet in a
?separate tab? that was not immediately visible to an employee unless he or she clicked on the tab. The information was exposed for 3 weeks before the incident was discovered during an audit.