Bell is apologizing to its customers after 1.9 million email addresses and approximately 1,700 names and phone numbers were stolen from a company database.
The information appears to have been posted online, but the company could not confirm the leaked data was one and the same.
Bell, the country’s largest telecommunications company, attributed the incident to “an anonymous hacker,” and says it is working with the RCMP to investigate the breach.
“There is no indication that any financial, password or other sensitive personal information was accessed,” the company wrote in a statement. Bell said the incident was unrelated to the massive spike in ransomware infections that affected an estimated 200,000 computers in more than 150 countries late last week.
It is not clear when the breach occurred, how the data was accessed, or how long the attacker had access to Bell’s systems.
In 2014, the RCMP charged a Quebec youth after a Bell contractor was breached and 22,421 user names and passwords and five valid credit card numbers were posted online.
Attacker warns ‘more will leak’
A person or group alleging to be behind the attack wrote in a post online that they were “releasing a significant portion of Bell.ca’s data due to the fact that they have failed to cooperate with us.”
“This shows how Bell doesn’t care for its customers safety and they could have avoided this public announcement,” the post continues. “Bell, if you don’t cooperate more will leak :)”
The post links to a set of files containing a long list of email addresses and related customer information that appear similar in size and substance to Bell’s description of the stolen data — but also includes phone numbers, locations, job titles and other pieces of information about more than 150 supposed Bell contractors and employees.
When reached by phone, Bell’s director of communications Marc Choma told CBC News that he couldn’t comment on the incident or the apparent archive of leaked data because the investigation was continuing.
RCMP spokesperson Harold Pfleiderer responded in an email, “Generally, only in the event that an investigation results in the laying of criminal charges, would the RCMP confirm its investigation, the nature of any charges laid and the identity of the individual(s) involved.”