P2017-ND-167

The Organization reported that on or about November 2, 2016, Calgary Police Services (CPS) informed the Organization that it was conducting a criminal investigation concerning the fraudulent use of personal information to apply for credit cards and there was a possible connection to approximately 40 individuals through a relationship with the Organization. The Organization confirmed to the CPS that approximately 30 of the persons identified by the CPS were tenants of the Organization. On November 29, 2016 the Organization received an update from the CPS regarding CPS?s ongoing investigation. That same day, the Organization initiated ?an internal privacy control investigation? and ?identified that an unknown person had accessed the [Organization?s] server after hours].? The Organization informed CPS, and CPS confirmed to the Organization that ?an Employee was accessing the server on a personal device and had stolen certain tenant personal information from [the Organization]?. The Organization ?understands from CPS that the Employee had the stolen personal information from [the Organization] and kept it on a computer at his home address and sold the stolen personal information for personal gain.? The Organization reported that during its discussion with the CPS on November 29, 2016, ?CPS would not disclose the nature of the personal information which had been taken, given that the matter was under a current criminal investigation.? The Organization reported that it ?does not know precise details of when the loss occurred. To the best knowledge of the organization, the loss occurred sometime between August, 2016 and November, 2016.?