Theft of Vancouver rape crisis centre server containing sensitive data raises privacy concerns

Cybersecurity experts are warning of "significant" data privacy risks after a Vancouver rape crisis centre told clients and donors a computer server containing their sensitive personal information and banking details was stolen from its office last month.

The Dec. 3 break-in at Salal Sexual Violence Support Centre's new downtown office is under investigation, Vancouver police confirmed in an email to CBC News Friday, and at least one woman who sought counselling at Salal says she is planning to file a complaint with B.C.'s privacy watchdog over the breach.

In a Dec. 23 email obtained by CBC News, executive director Dalya Israel told Salal clients that a backup server with their waitlist and contact information was among the items stolen from the office, which is currently being renovated.

"It is possible that your name, email address, telephone numbers, and notes about safety risks or what services you have requested could be released, sold and shared publicly," Israel wrote.

However clients' individual files, case notes and medical information were not compromised because they are held on an encrypted third-party platform, she said.

The stolen server also contained donor bank account details and pictures of cheques — including names, addresses, and phone numbers — according to a separate email to donors obtained by CBC News.

Credit card and debit card information from online donations is stored on an encrypted third-party platform and remains safe, Israel said.

"This was not a data 'hack,'" read her email. "We do not believe that this break-in was targeted to destabilize Salal SVSC or the survivors that we serve."

Israel said Salal believes the risk of data being stolen or misused is low because accessing the data "requires sophisticated" IT knowledge, adding that an independent privacy impact assessment estimated the risk as moderate. 

"We are of course very concerned with any possible data breach ... and we are doing everything we can to make sure that this cannot happen again," Israel wrote.

However it is still unclear how many people's data may have been compromised or how vulnerable it may be.

Israel declined an interview request from CBC News on Friday.

In a Sunday emailed statement, she declined to answer questions about how the stolen data was stored "to protect the integrity of the investigation and information on the hardware."

Israel says the theft has been "devastating" for Salal, and in her emails she noted the potential breach could be distressing or triggering for clients and donors.