The Yukon government is dealing with yet another data breach.

Somehow, a USB key fell into the wrong hands.

Health and Social Services Minister Tracy-Anne McPhee said Monday afternoon her last information suggests the data breach may have affected between 30 and 60 people, but that number may change.

According to a brief press release issued last Friday, YG had been informed of the breach the previous Thursday.

The release stated, “A private citizen appears to have obtained confidential government records that belong to the Department of Health and Social Services.

“The Government of Yukon is working in close co-operation with the Information and Privacy Commissioner as well as the RCMP to investigate the breach and mitigate potential risks.”

Jason Pedlar, the Yukon’s Ombudsman, is also involved in the investigation.

This follows a prior data breach that involved a member of the Department of Education emailing sensitive information of Yukon post-secondary students who had applied for a Yukon Grant in 2022 to an unknown member of the public.

That mishap occurred in the form of a spreadsheet emailed on Aug. 24. It included names, addresses, phone numbers, email addresses and social insurance numbers of the students.

Following question period in the Yukon legislature Monday, reporters met with Opposition Leader Currie Dixon.

“It’s certainly concerning to hear when individuals’ private information has been leaked or made public somehow,” said Dixon.

“I don’t have a lot of information about this particular case and anything more than what’s been reported already, although it does seem like they’ve learned from the education data breach where they’ve actually engaged immediately.

“In the case of the education breach, it took a matter of weeks for them to notify those affected and engage with the Information Privacy Commissioner’s (IPC’s) Office,” Dixon noted.

“In this case, it sounds like they’ve gotten to the IPC immediately, and so we look forward to seeing how the IPC does its work and what follow-up comes from them.”

NDP Leader Kate White said the latest privacy failure “goes on to highlight the concerns that … I raised about the access to information about the training that happens.

“And again, this isn’t the problem of the individuals within the department. This is a systemic training issue … this responsibility, you know, lies at the feet of the government – making sure that their staff are trained, that they’re comfortable and competent with what they’re doing.”

The unfortunate truth, White added, is “Yukon Government has shown that they are not capable of keeping people’s personal information.

“This is an example they’ve shown, you know, not just once but twice in a very public way that they are not good at keeping this information, that they’re not good at storing it, that they’re not good at keeping it secure. And that’s a problem.

“So what I want to see is a revamping. I want to know what they’re going to do to address these issues because obviously there’s a concern.”

McPhee, who is also the Justice minister, told the media, “We were made aware of a privacy breach involving the Department of Health and Social Services by … the Office of the Information and Privacy Commissioner.

“We immediately followed the protocols that are in place, and in co-operation with the information and Privacy Commissioner and the RCMP are working to review this breach as well as to identify and notify all the affected individuals … impacted individuals will be contacted directly as soon as possible.”

The breach was fully contained within 24 hours, McPhee said.

“It is dated information, and the Department of Health and Social Services has replaced its case management system to one where files are now only accessible through government court, with security log-in,” she added.

McPhee said governent officials “will be notifying everyone that is affected as soon as possible. And we are confident that all of the information that is contained on that USB key has been recovered and secure.”

Asked how the data breach occurred, McPhee simply said, “I can’t tell you that. I’m waiting for that information. That’s part of the investigation.”

She was also not prepared to divulge who is responsible for the breach.

“It’s not that I’m not willing. The investigation is ongoing. And as I’ve said, as soon as we have more information, we’ll provide it.”

The minister also couldn’t say what type of information has been released.

“What we’re working now is to determine what information has to be provided back to the Information Privacy Commissioner and then begin notifying people.”

She was asked if there is a timeline on the investigation.

“Quite frankly, we want to be able to start notifying people as soon as possible. We hope to be able to do that within the next number of hours, perhaps days.”

Questioned about the process involved with the data breach, McPhee replied, “I’m not going to speculate what happened here or – it wouldn’t be appropriate for me to do so.

“The investigation has to be done properly, has to be done thoroughly and it has to be done quickly so that we can advise individuals of what effect there is, if any, on their personal information.

“But I guess I need to make sure that I reiterate that we are completely confident that all of the information that was contained on the USB key has been secured and returned to Health and Social Services and is now secured.”