Data breach at the Liquor Control Board of Ontario compromised customers' personal information

The Liquor Control Board of Ontario, Canada’s largest beverage alcohol retailer, said it suffered a data breach that compromised the sensitive personal information of its customers.

In an email sent to customers, the Liquor Control Board of Ontario (LCBO) said that on August 9, it was notified by one of its service providers, Conversion Digital, about a cyber security incident that involved a threat actor accessing its customers’ personal information.

Conversion Digital provides LCBO with curated marketing strategies, including sending promotional emails and newsletters to its subscribers.

According to media reports, the compromised information included LCBO customers’ names, dates of birth, postal codes, and their Aeroplan numbers. The company clarified that passwords and financial information, including credit and debit card information, wasn’t impacted by the cyber security incident.

LCBO has notified the Office of the Information and Privacy Commissioner of Ontario about the security incident and is working with government agencies to resolve the matter as soon as possible.

Earlier this year, the company confirmed that on January 10, it suffered a “cybersecurity incident, affecting online sales through LCBO.com.” The company took immediate steps to contain the incident and disabled customers’ access to both LCBO.com and its mobile app.

“At this time, we can confirm that an unauthorised party embedded malicious code into our website that was designed to obtain customer information during the checkout process,” the company said. “Unfortunately, customers who provided personal information on our check-out pages and proceeded to our payment page on LCBO.com between January 5, 2023, and January 10, 2023, may have had their information compromised.”

The compromised information included the names, email and mailing addresses, Aeroplan numbers, LCBO.com account passwords, and credit card information of LCBO’s customers. The security incident, however, did not affect any orders placed through the LCBO mobile app or vintagesshoponline.com.

“Out of an abundance of caution, we recommend all customers who initiated or completed payment for orders on LCBO.com during this window monitor their credit card statements and report any suspicious transactions to their credit card providers,” the company added.