P2020-ND-102

On July 22, 2020, the Organization?s third-party account takeover and fraud analysis vendor notified the Organization of an unusual pattern of activity. The Organization investigated and discovered a malicious actor performed a credential-stuffing attack by testing breached email and password combinations that were obtained outside of the Organization. The Organization estimates that approximately 160 Alberta accounts were affected by this vulnerability between April 2020 and July 31, 2020.