An expert on information security has called for the release of more information about an incident in which criminals gained access to the highly confidential records of a major consumer-credit reporting agency.
Mary Kirwan, a former prosecutor in the RCMP's Integrated Proceeds of Crime Unit, said the 1,400 people whose credit reports were accessed at Equifax Canada Inc. need to know some key details to protect themselves from identity theft.
"Given the vague nature of the description given by the company, you may not be in a position to estimate the likelihood of threat to you," she said.
"If this was done by a couple of kids who had a friend inside at Equifax who started selling passwords, that's one thing. In that case, I'd be watching my credit cards like a hawk. But if it's linked to Eastern European criminal gangs linked to extortion, that's something else again, and I would be a lot more concerned."
Equifax confirmed on Monday that the credit reports of about 1,400 consumers, primarily in British Columbia and Alberta, "were accessed by criminals posing as legitimate credit grantors."
Joel Heft, vice-president of Equifax, said that because the matter is under investigation by the company and the RCMP, more details cannot be released.
Some information, including whether or not organized crime is involved, isn't known yet, he said.
Ms. Kirwan said it's difficult for authorities to talk for fear of jeopardizing an ongoing investigation, but she urged them to release as much information as they can as quickly as possible.
Equifax is one of two national companies that compiles credit records on consumers across Canada, using data provided by credit grantors such as banks, credit-card companies and retail outlets.
Credit records typically include social insurance numbers, bank account numbers, home and work locations, spouses' names and six years of credit and banking history.
With that "bundle of information," someone could build a fake identity, applying for credit cards and opening bank accounts in a stolen name, Ms. Kirwan said.
"Let's say someone builds that identity; not only will they run up a credit card, they may buy a car, entertainment equipment . .. and they may sell your data. It can get worse and worse as more and more people get access to this information in the criminal world.
"If they can build your file, the least of your worries may be your credit card and the losses they can accumulate on that.
"If they dig, they can get a health card, a driver's licence. Getting a passport is more difficult since 9/11, but it's not impossible."
Ms. Kirwan said people should not assume that they are protected by their credit-card companies.
"Credit-card companies will tell you it doesn't really affect you because they have the zero liability on the credit card. If there's a problem [with your card being used by someone else] the credit-card company and the banks will investigate, but you won't be held responsible. . . . But where it gets a lot dodgier is if the person who has stolen your data, then moves beyond that particular institution and beyond that card, and builds a general identity in your name.
"Once they have done that, they can go up to all kinds of other retailers or financial institutions or whoever they want, buy goods in your name, and then your only recourse is law enforcement. You have to hope that they catch these guys and that you can get the money back" from whoever stole your identity.
The United States has some safeguards to allow consumers to protect themselves from identity theft, Ms. Kirwan said. Banks, for example, have a common clearinghouse so that when an alert is put on a name, all major banks have that warning in their files. In Canada, that safeguard doesn't exist.
After learning of the security breach in February, Equifax began notifying consumers by registered mail, and the company posted an alert on credit files of affected consumers at both Equifax and the other national credit-reporting agency, Trans Union of Canada.
In a statement, Equifax also said it is providing consumers with a free one-year subscription to Credit Alert, a service that monitors credit file activity and alerts a consumer immediately of changes that could signal identity theft.
Equifax has also set up a team to work with consumers affected by the incident and has given them a special phone number to call.
Anne-Marie Hayden, a spokeswoman for the federal Privacy Commissioner, said her office learned of the incident yesterday, after reading it in The Globe.
"Obviously it's something we're concerned with," she said. "Today we received notice from Equifax. We have opened an incident file."
Public Safety and Emergency Preparedness Canada reports that identity theft "has become one of the fastest-growing crimes in Canada and the United States."
The U.S. Federal Trade Commission received more than 160,000 complaints of identity theft in 2002. In Canada there were more than 7,600 complaints involving losses of more than $8.5 million.
The targeting of big databases is rare, but not unknown.