‘Also affected’: Watson brings ‘data breach’ to Senate

Claims that a data breach had exposed customers’ accounts at two Canadian-owned banks were flatly denied by one bank while the other was yet to respond late Wednesday.

The alleged data breach made it to the floor of the Senate as Opposition Senator Tricia Watson said she, too, had been affected by the alleged breach.

Scotiabank responded to queries from Barbados TODAY regarding a post by cybersecurity expert Neil Harper who questioned whether it and RBC Royal Bank had been hacked.

Harper, a chief security information officer, made this claim via social media: “I have been contacted more than 30 times by individuals who have seemingly been directly or indirectly affected by unauthorised withdrawals or unknown charges to bank accounts at Scotiabank (Barbados) or RBC Royal Bank (Barbados).

“Individuals claim to have experienced their bank accounts being emptied of amounts ranging from USD $500 [$1 000]  through USD $5 000 [$10 000] and even higher in some cases.”

But Scotiabank categorically dismissed any suggestion of a data breach.

“Scotiabank has been made aware of a blog circulating that purports that there has been a data breach impacting customer accounts. This information is unfounded, and the bank confirms that there has been no breach,” it said in a statement.

“Scotiabank remains committed to keeping customer accounts and financial information safe and secure and has established strong measures and safeguards to protect the confidentiality, integrity and resilience of our systems that process and maintain personal information.”

Scotia reminded customers that the bank would never ask for their PINs, passwords, and account numbers and cautioned them not to respond to text messages, e-mails, or websites that request personal information.

Barbados TODAY also reached out to RBC Royal Bank amid claims that its customers’ accounts had been exposed to a data breach and was told to expect a statement.

No statement from the bank was received up to the time of publication.

As the Senate debated the Financial Institutions (Amendment) Bill, newly-appointed Opposition Senator Tricia Watson declared that she had found herself “affected at this moment” by a breach.

While not naming the bank, she told the Senate: “Even now as we speak, there is…I can say it because it has occurred to people that I know, and to me…a data breach that seems to be quite profound occurring in a banking institution in this country. The problem that we have is that we get no notification.

“That is problematic for many reasons; but in particular, it also does not line up with the data protection law that was put in place in this country recently. We therefore need to have a regulator who will say to the banks, whether by guidelines or by regulations or by an act, ‘These are the responsibilities that you have when a data breach occurs in your bank.'”

The opposition lawmaker and consumer advocate advised that banks should be required to fix the problem, and notify and even compensate customers “because consumers cannot be left to flounder and to fight with the bank to get information and get a solution when that kind of situation occurs”.

“I feel very strongly about this,” she continued, “not because I find myself affected at this moment; but it happens regularly, and we know [that] with technology and with the opportunity to hack, in some instances it is a very simple process…or in some other instances it is something that is done over a long period of time.

“Vulnerable banking customers must be able to do their business, assume that their information would be protected…and in that respect, I must also say that a data breach for me, might mean a data breach for an associate or a relative, because ‘know your customer information’, information that is required now to set up an account, would sometimes as ask our relatives about us, and it may ask us about our relatives.

“Therefore, that data is taken from the bank and utilised for other nefarious purposes, and that has to be addressed. We cannot leave that lacuna remaining in our system.”

The Central Bank was on Wednesday monitoring the situation, Barbados TODAY was told.

emmanueljoseph@barbadostoday.bb