The Yukon Party says it has been “inundated with concerns from Yukoners” about a significant privacy breach involving the Department of Education.

The Yukon government made no public announcement about the breach.

It has confirmed that letters have been sent to those who may have been affected – three weeks after the incident occurred.

The breach involved a member of the department emailing sensitive information of Yukon post-secondary students who had applied for a Yukon Grant in 2022 to an unknown member of the public.

The government has been unable to contact that individual.

The information was sent via a spreadsheet on Aug. 24.

It included:

• names;

• addresses;

• phone numbers;

• email addresses; and

• social insurance numbers.

“This is a disturbing breach of Yukoners’ private information,” Scott Kent, the Yukon Party’s education critic, said Thursday afternoon.

“Those who had their privacy compromised are only being informed this week in a letter dated September 15.

“It is concerning the minister of Education (Jeanie McLean) did not prioritize notification at the earliest possible opportunity.”

Besides the question of why it took so long for the breach to become public, the Yukon Party said, there are several questions the government needs to answer:

Why was such information stored in a spreadsheet and not a secure database?

What actions are underway to track down the recipient of the information, instead of just reaching out electronically?

When was the Yukon’s Information and Privacy Commissioner notified of the breach?

Will the department and the Liberal government ask the commissioner to help improve processes going forward?

Finally, what will be the cost to Yukon taxpayers to provide one year of credit monitoring for those affected by the breach?

“We are also asking when did the minister become aware of the breach, and did she inform her cabinet colleagues?” added Kent.

The Star relayed these questions to the government on Thursday afternoon.

The response was this emailed statement from a department spokeswoman:

“The Department of Education takes the protection of personal information and privacy very seriously.

“We can confirm the Department of Education experienced a privacy breach on August 24, 2022. The breach has now been contained and the risk of this information being used in an inappropriate matter is being mitigated.

“Communication will be sent to the impacted individuals to provide them of this update.

“The breach was immediately reported to the departmental privacy officer, and the department has been following the Government of Yukon’s privacy breach procedures. This includes working with the Office of the Information and Privacy Commissioners.

“Letters were sent to notify all individuals impacted by the breach and offer credit monitoring protection, coordinated and paid for by the department.

“The department is actively reviewing internal training and processes to help prevent privacy breaches in the future.”

The Star asked the spokeswoman how many letters about the breach have been sent out. She released this statement this morning:

“537 letters were sent to impacted individuals. The Department of Education is also updating all of the impacted individuals by email today that the breach is confirmed to be contained and the risks mitigated.

“In the individualized letters, the department provided information on how those impacted can access credit score monitoring and other protection supports, organized and paid for by the Department of Education.”