Communauto data breach traced to employee's unauthorized script, company says

Montreal-based car-sharing company Communauto said an employee deployed an unauthorized automated script that attempted to access and download customer records, resulting in a data breach that affected roughly 2 percent of its members across Canada.

In an email sent to affected customers Monday evening, Communauto said its investigation determined the incident occurred during the night of Sept. 3 to 4. The company said an employee deployed the script without authorization in an attempt to access and download customer records. Montreal police executed a search warrant the following day at the employee’s residence and seized computer equipment.

Communauto said account passwords and payment information were not affected, but that personal information, including customers’ names, addresses and driver’s license numbers, was. The company said photographs of customers or of their licenses attached to their files were also downloaded where they existed.

Marco Viviani, Communauto’s vice-president of strategic development, told CBC the breach affected about 2 percent of the company’s users, characterizing the number as "some thousand members" nationwide. He said the company hired a specialized consulting firm to monitor the web and dark web for signs that the data had been exposed.

"At this stage, we hope that no data was disclosed externally," Viviani said. "Based on the information available to us, we did not believe it was necessary for anyone to be taken into custody, but we have not received any additional details since law enforcement became involved."

Communauto said it has retained independent cybersecurity experts to validate its findings, determine the scope of the incident and continuously monitor publicly accessible internet sources and the dark web for related activity, adding that its investigation and analysis remain ongoing. The company said members who did not receive an emailed breach notification were not among those whose information was potentially compromised.

Communauto advised affected members to remain cautious of unsolicited emails, phone calls and text messages, particularly those requesting personal information or payment, demanding urgent action, or encouraging them to click a link or open an attachment. The company recommended customers set up multi-factor authentication and ensure their account passwords are strong and unique. Members with questions about the incident can contact the company at personaldata@communauto.com.