Communauto says it was hit by data breach initiated by its own employee

The Montreal car-sharing company Communauto said it was hit by a potential data breach after one of its employees tried to access customers’ personal information.

In an email sent to affected customers on Monday evening, Communauto said the incident happened during the night of Sept. 3 to 4.

“Our investigation determined that an automated script had been deployed without authorization by an employee in an attempt to access and download customer records,” the email reads.

The company says police executed a search warrant the next day at the residence of the employee suspected of carrying out the breach to seize their computer equipment.

Communauto says account passwords and payment information were not affected by the breach, but that personal information, including people’s names, addresses and driver’s licence numbers, was. If the customer had a photograph of themselves or of their licence attached to their file, then those were downloaded as well.

In a statement to CBC, Communauto’s vice-president of strategic development, Marco Viviani, said the breach affected about two per cent of its users, representing “some thousand members” Canada-wide.

“At this stage, we hope that no data was disclosed externally,” he said.

“Based on the information available to us, we did not believe it was necessary for anyone to be taken into custody, but we have not received any additional details since law enforcement became involved.”

Viviani says the company hired a specialized consulting firm to monitor the web and dark web for any signs of data exposure.

Communauto says those affected by the breach should “remain vigilant regarding unsolicited emails, phone calls, and text messages, particularly those requesting personal information, payment, urgent action, or encouraging you to click on a link or open an attachment.”

It says customers should set up multi-factor authentication and make sure their account password is strong and unique.