P2020-ND-146

The Organization uses a service provider, ADP Canada, to manage its employees? self-service accounts. On September 28, 2020, an employee of the Organization reported that he received a notification that a mobile number change was made to his ADP profile, and a time-off request was entered that he did not make. ADP Canada advised the Organization that a technical issue with a password recovery process enhancement may have led to another ADP client?s employee inadvertently accessing personal information of the Organization?s employee. The breach ended on October 2, 2020.