'Flabbergasted': Some Mainstreet tenants say they weren’t informed about the data breach
A week after one of the largest rental property companies in western Canada revealed the extent of a data breach that happened three months prior, tenants are saying they've learned of the cybersecurity attack from CTV News, and not the company.
"In May 2024 this happened and we're now in August and yeah, nobody told us a thing 'till we found out on our own," tenant Melanie Sylvestre said.
"They were supposed to have that security in place already, and now it's hacked. I'm just flabbergasted."
Last week, Mainstreet Equity Corporation sent a letter to some tenants and posted a statement on its website saying it discovered a third party had gained access to a portion of its IT infrastructure on May 21.
The letter says an investigation revealed personal information belonging to tenants or guarantors may have been compromised, including their names, date of birth, court applications and banking information.
Sylvestre says more than three months after the cyberattack happened, she only learned of the attack after reading a CTV News story while scrolling on her phone.
"I still to this day have not received a letter, an email, a phone call," she said Monday. "They expect so much from tenants. Well, we expect that respect."
In its letter, Mainstreet – which owns more than 18,000 rental units across western Canada, says it "issued a news release" on May 24 about the incident before it had an opportunity to complete its own investigation.
"After completing a careful review of the information involved, we directly notified individuals we believe to have been impacted by this incident who we have contact information on file for," a statement from the company read.
"We also posted a notice on our website targeting individuals we do not have contact information for."
Chad Jones, CEO of software company Push Interactions, says the company should have had better security protocols in place to start with, and tenants should have been notified immediately, rather than a posting on the investor section of its website.
"About as serious as you can get when it's that detailed of information," Jones said. "And for them to take months to notify people, it really should have been done right away."
While the company maintains there is no evidence suggesting that anyone's personal information was or is being used by an unauthorized user, Jones said that may have happened in the three months before it was announced.
Sylvestre is worried it may take years for her to learn someone took out a loan in her name.
"And then the work to prove it wasn't you," she said. "That's on us."
"That's a very scary prospect that you got somebody that has your name, real address, everything," Jones said. "And including your banking information, they can take that and do all kinds of things with it."
Jones says there could be legal implications for the company because of the sensitive information that could have been hacked and its communications to its clients since the incident happened. The idea has already cross Sylvestre's mind.
"That's actually what I had told my husband. I think we need a class action suit. Like, I wanted to go and write out on a paper and tape it to all of the doors here to let tenants know," she said.
Sylvestre said the most detailed confidential information needed to be handed over prior to her moving into her unit two years ago, and she was assured her information was safe.
"The attackers have it and you know, they say, 'oh, we don't have any evidence that anything's happened,'" Jones said. "Well, of course they're not going to sit on it and do nothing with it."
The company says it has more than 125 properties and approximately 3,600 units in Saskatchewan. On its website, the company boasts about it having a 15 per cent market share of Saskatoon with more than 2,600 units in the city.
Given its large profile, Jones was surprised Mainstreet isn't certified by Cybersecurity Canada, didn't take proactive measures to prevent a cyberattack and didn't utilize a third-party company to shore up any weaknesses.
"It should be something that they should have spent a lot of time and actually got the proper certifications," he said.
Sylvestre said learning of the cyberattack was devastating, and she fears what it could mean for her years into the future knowing someone out there may have all of her personal information, and plenty of personal information about her children.
"Somebody is going to get hurt in this. And no, it's not Mainstreet, because it wasn't their information that got hacked," she said.
Mainstreet is offering a complimentary 12-month subscription for identity theft and credit monitoring services through Equifax.
Third-party cybersecurity experts have been retained to assist Mainstreet, which says it is working with external legal counsel to ensure it meets its legal obligations.
-With files from Matt Young
CTVNews.ca Top Stories
Ontario's top court dismisses application for bail from Jacob Hoggard
A justice with Ontario's Appeal Court has dismissed an application for bail from Canadian musician Jacob Hoggard as he tries to appeal his sexual assault conviction at the country's top court.
Driver charged with killing NHL's Johnny Gaudreau and his brother had .087 blood-alcohol level
The driver charged with killing NHL hockey player Johnny Gaudreau and his brother Matthew as they bicycled on a rural road had a blood-alcohol level of .087, above the .08 legal limit in New Jersey, a prosecutor said Friday.
LIVE UPDATES Air Canada flights could halt next week: Here's the latest
Air Canada's potential work stoppage could ground flights, halt cargo and leave travellers scrambling to reschedule next week. Follow along with live updates here.
Former NHL enforcer Stephen Peat dies after being hit by car in B.C.
Stephen Peat, the former Washington Capitals enforcer who fought concussion issues and was homeless at times after leaving hockey, has died from injuries sustained late last month when he was struck by a car while crossing a street. He was 44.
Trudeau says Ukraine can strike deep into Russia with NATO arms, Putin hints at war
Prime Minister Justin Trudeau says Ukraine should be allowed to strike deep inside Russia, regardless of Moscow threatening that this would draw Canada and its allies into direct war.
2 suspects charged after Lamborghini stolen in armed home invasion in Richmond Hill: police
York Regional Police say they have arrested two suspects and are looking for at least one more following an armed home invasion in Richmond Hill that saw thieves escape in the victim’s Lamborghini.
NDP caving to Poilievre on carbon price, has no idea how to fight climate change: PM
Prime Minister Justin Trudeau says the NDP is caving to political pressure from Conservative Leader Pierre Poilievre when it comes to their stance on the consumer carbon price.
Scientists who discovered mammals can breathe through their anuses receive Ig Nobel prize
The world still holds many unanswered questions. But thanks to the efforts of the research teams awarded the IG Nobel Prize on Thursday, some of these questions – which you might not even have thought existed – now have answers.
Canadian woman dies after being caught in a sudden snowstorm in Italy's Dolomite mountains
A 56-year-old Canadian woman died after being caught in a sudden snowstorm in Italy’s Dolomite mountains and her companion was being treated for severe hypothermia, Italy’s Alpine Rescue Corps said Friday.