P2016-ND-32

The Organization launched a consumer panel recruitment survey on January 19, 2015. Due to a flaw in the survey application, when a customer clicked on the URL link to fill out the survey, the customer found the survey was already pre-populated with responses provided by another individual. Customers completing the survey reported the incident to the Organization. Fourteen customers contacted the Organization to report the issue. The Organization reported that the survey was mistakenly launched in the test environment instead of production environment-the link to the survey led to the test environment. The Organization reported that 4,090 customers started the survey; 1,371 actually completed it and submitted it to the Organization. The personal information was exposed for approximately 2 hours before the survey was taken down.