'Flabbergasted': Some Mainstreet tenants say they weren’t informed about the data breach

A week after one of the largest rental property companies in western Canada revealed the extent of a data breach that happened three months prior, tenants are saying they've learned of the cybersecurity attack from CTV News, and not the company.

"In May 2024 this happened and we're now in August and yeah, nobody told us a thing 'till we found out on our own," tenant Melanie Sylvestre said.

"They were supposed to have that security in place already, and now it's hacked. I'm just flabbergasted."

Last week, Mainstreet Equity Corporation sent a letter to some tenants and posted a statement on its website saying it discovered a third party had gained access to a portion of its IT infrastructure on May 21.

The letter says an investigation revealed personal information belonging to tenants or guarantors may have been compromised, including their names, date of birth, court applications and banking information.

Sylvestre says more than three months after the cyberattack happened, she only learned of the attack after reading a CTV News story while scrolling on her phone.

"I still to this day have not received a letter, an email, a phone call," she said Monday. "They expect so much from tenants. Well, we expect that respect."

In its letter, Mainstreet – which owns more than 18,000 rental units across western Canada, says it "issued a news release" on May 24 about the incident before it had an opportunity to complete its own investigation.

"After completing a careful review of the information involved, we directly notified individuals we believe to have been impacted by this incident who we have contact information on file for," a statement from the company read.

"We also posted a notice on our website targeting individuals we do not have contact information for."

Chad Jones, CEO of software company Push Interactions, says the company should have had better security protocols in place to start with, and tenants should have been notified immediately, rather than a posting on the investor section of its website.

"About as serious as you can get when it's that detailed of information," Jones said. "And for them to take months to notify people, it really should have been done right away."

While the company maintains there is no evidence suggesting that anyone's personal information was or is being used by an unauthorized user, Jones said that may have happened in the three months before it was announced.

Sylvestre is worried it may take years for her to learn someone took out a loan in her name.

"And then the work to prove it wasn't you," she said. "That's on us."

"That's a very scary prospect that you got somebody that has your name, real address, everything," Jones said. "And including your banking information, they can take that and do all kinds of things with it."

Jones says there could be legal implications for the company because of the sensitive information that could have been hacked and its communications to its clients since the incident happened. The idea has already cross Sylvestre's mind.

"That's actually what I had told my husband. I think we need a class action suit. Like, I wanted to go and write out on a paper and tape it to all of the doors here to let tenants know," she said.

Sylvestre said the most detailed confidential information needed to be handed over prior to her moving into her unit two years ago, and she was assured her information was safe.

"The attackers have it and you know, they say, 'oh, we don't have any evidence that anything's happened,'" Jones said. "Well, of course they're not going to sit on it and do nothing with it."

The company says it has more than 125 properties and approximately 3,600 units in Saskatchewan. On its website, the company boasts about it having a 15 per cent market share of Saskatoon with more than 2,600 units in the city.

Given its large profile, Jones was surprised Mainstreet isn't certified by Cybersecurity Canada, didn't take proactive measures to prevent a cyberattack and didn't utilize a third-party company to shore up any weaknesses.

"It should be something that they should have spent a lot of time and actually got the proper certifications," he said.

Sylvestre said learning of the cyberattack was devastating, and she fears what it could mean for her years into the future knowing someone out there may have all of her personal information, and plenty of personal information about her children.

"Somebody is going to get hurt in this. And no, it's not Mainstreet, because it wasn't their information that got hacked," she said.

Mainstreet is offering a complimentary 12-month subscription for identity theft and credit monitoring services through Equifax.

Third-party cybersecurity experts have been retained to assist Mainstreet, which says it is working with external legal counsel to ensure it meets its legal obligations.

-With files from Matt Young