P2018-ND-014

In 2009, thirty-eight (38) employees were terminated from the Organization and their employee files placed in an envelope, boxed-up and moved to long term storage in the basement of the Organization?s facility. In the fall of 2015, as part of a routine purge of documents that had exceeded their retention period, confidential documents were sent offsite for third party shredding and non-confidential documents were sent for third party recycling. On February 13, 2017, the Organization learned from a police service that unauthorized third parties were in possession of life insurance enrollment forms used by the Organization to enroll its employees in the Organization-provided insurance benefit plan. The Organization learned that credit cards were fraudulently obtained or identities misappropriated for 21 former employees, using the information on the insurance forms. The Organization investigated and believes that insurance forms that were intended for shredding were inadvertently sent to a recycling facility where they were passed on to the unauthorized third party. The Organization does not believe the insurance forms were taken from its own facility as there were other ?higher value? documents readily available there, and none of these were discovered by the police service.