P2017-ND-091

On July 14, 2014, an individual entered one of the Organization?s stores in British Columbia purporting to be a customer of the Organization. The individual requested a copy of her customer transaction history and registration form, and provided a social insurance card and native status picture ID card as identification. A clerk reviewed the identification, matched the information with the Organization?s records, and proceeded with the transaction. The information at issue was provided to the individual. On July 16, 2014, the Organization was notified by the RCMP that the individual had been taken into custody. The individual was identified by the Organization?s staff as being the person who appeared in the store on July 14, 2014 and obtained the information at issue, after representing herself as a customer of the Organization. The Organization believes that the affected customer?s personal information was breached prior to the July 14 incident and that the individual apprehended by the RCMP had earlier attempted to obtain an on-line loan under the name of the affected customer.