‘Increasingly sophisticated’: Data breach affecting Williams Food Equipment puts customers on alert

The Consumers Council of Canada is calling for greater protections following cyber breach.

A consumer advocacy group is urging customers to take their cyber security seriously following one of the latest examples of data breaches in Windsor-Essex reported at Williams Food Equipment earlier this month.

On Oct. 9, the Windsor restaurant and home kitchen supplier reported a third-party partner associated with its online store suffered a security breach which compromised personal information of its customers and made them stronger targets for scams.

“The online efforts are becoming increasingly sophisticated, and the protections are that much harder to keep in place,” said Barb Amsden, a board director with the Consumers Council of Canada, in an interview with CTV News on the matter.

The company reported names, telephone numbers, payment methods, and other transaction information were compromised in the hack carried out between Sept. 13 – 17, opening customers to more convincing scams using the retrieved information, most likely through phishing attempts.

In its email to customers, the company said it was assured by the unnamed partner there was no evidence credit card numbers, security codes, or passwords were accessed.

According to the Canadian-Anti Fraud Centre (CAFC), criminals can use accurate information to create more convincing communications aimed at potentially vulnerable targets, which makes independent verification of unexpected requests more important.

Amsden encourages victims of data breaches like these to report to appropriate agencies; police, financial institutions, and the CAFC. And then to monitor in order to flag if, and when, suspicious activity occurs.

“Reporting to them is helpful in that it helps flesh out just the extent of the problem and the fact that it’s growing. I mean, I think that that’s the worst thing is it’s growing exponentially,” said Amsden. “It’s only once there are enough people reporting and enough people are showing extreme concern that this issue, the additional simple measures that can be put in place, are going to be done.”

The CAFC reports it has not received any complaints concerning the breach affecting Williams Food Equipment customers but encourages reporting even if a situation seems minor.

“Reporting fraud to the CAFC remains an important step, even when no financial loss has occurred,” said Jeff Horncastle, a spokesperson for CAFC, in an email to CTV News. “Information collected through these reports helps us identify emerging fraud trends, recognize patterns, link related incidents and develop intelligence that can support law enforcement investigations and fraud prevention initiatives.”

In its email to customers, Williams Food Equipment said the third-party partner has “engaged external cybersecurity specialists” to investigate and assist with remediation. It also advised best practices to guard against phishing and other scam attempts.

The company has not responded to repeated requests for comment by CTV News.

Next steps

Amsden says it can be confusing for victims of data breaches and cybercrime to know what to do next and, at times, challenging to work through bureaucracies in an effort to restore protections and a sense of security.

Something she knows first-hand, having twice been involved in breaches that left her more than frustrated.

“A considerable amount of anger,” she said. “A scammer had in fact managed to change my home address to 750 Lawrence [Ave. W] in Toronto, which is actually the location of a financial institution and also of one of the two credit bureaus so, it was a fluke that I found out about it. So, I consider myself lucky, but angry, and then very much compelled to do something about this to help other people.”

Amsden has been advocating for governments to legislate free credit locks, also known as credit freezes, to help consumers protect against unauthorized access to credit reports and fraudulent account openings in the wake of data breaches.

The Ontario government enacted just that as of July 1, but Amsden believes free access to more credit bureau services is required to help consumers protect themselves from the growing cybersecurity problem.

“It’s a business responsibility, but it’s also a government responsibility to find better ways and then it’s our individual responsibility to see what action we can take as quickly as possible,” said Amsden.

One such measure would be automated notifications, similar to those done by credit card companies to notify customers of account transactions.

“They should be as interested in doing this as Google or as Microsoft Office or as any of these other types of platforms now are,” she said. “Like, ‘Did you sign on at this platform?’ They should absolutely be doing this free of charge.”

Consumer recourse

Civil courts may also be a recourse for consumers, but with only an estimated 5 per cent of breaches reported according to Amsden, even fewer rise to the level of a case that would pursue compensation.

And even then, that usually only comes after reports are made.

The CAFC describes itself as the central repository for information and intelligence related to fraud, but does not have the mandate for corporate investigations, instead focusing on prevention, awareness, intelligence gathering and law enforcement support.

“While the CAFC encourages individuals to report suspected fraud, including incidents involving the fraudulent use of compromised personal information, our role does not extend to investigating corporate data breaches, determining organizational accountability or providing legal recourse or compensation to affected individuals,” said Horncastle.

The CAFC points to the Office of the Privacy Commissioner of Canada (OPC) as another outlet for victims, looking for a response to questions concerning an organization’s responsibility in protecting personal information.

For those concerned their compromised information has been used to commit fraud or supported other scamming attempts, reporting to police and the CAFC are advised.

Amsden encourages those working through the systems in place to keep pushing forward.

“It kind of goes up and down and I would encourage people not to give up,” she said. “And the main thing is I think people need to know how to check and protect themselves using the credit bureaus.”

Cybersecurity awareness

October was Cybersecurity Awareness Month, and the CAFC implores the public to be alert to fraud trends and circulating scams.

It notes, while a data breach does not automatically mean someone will be defrauded, the heightened opportunity for criminals means awareness and preventative measures are particularly important.

The CAFC recommends the following precautions:

• Determine what information may have been exposed.
• Review official communications from the affected organization to understand whether the incident involved contact information, passwords, financial details or other sensitive personal information. The nature of the information compromised will help determine which protective measures may be necessary.
• Be cautious of unexpected communications as fraudsters may exploit publicized data breaches by impersonating businesses, financial institutions or government agencies. They may contact individuals by telephone, email or text message, claiming there is an urgent security issue, suspicious account activity or a need to verify personal information.
• Be particularly cautious of communications that create a sense of urgency or pressure you to disclose information, click on links or transfer money.
• Independently verify who you are communicating with.
• If you receive an unexpected call or message claiming to be from your financial institution or another trusted organization, do not rely on the information provided by the caller.
• Fraudsters can manipulate caller ID information to make telephone calls appear legitimate. Hang up and contact the organization directly using a trusted telephone number, such as the one on the back of your bank card or its official website.
• Protect your online accounts. If account credentials may have been compromised, change affected passwords immediately, including on other accounts where the same passwords have been reused.
• Use strong, unique passwords and enable multi-factor authentication wherever possible.
• Never share one-time verification codes with someone who contacts you unexpectedly, regardless of who they claim to represent.
• Monitor financial accounts and credit information.
• Regularly review banking and credit card statements for unauthorized transactions and monitor credit reports for suspicious activity. Individuals whose sensitive identifying information may have been compromised should consider contacting Equifax and TransUnion, Canada’s two major credit bureaus, to discuss placing fraud alerts on their credit files and other available protective measures.
• Contact your financial institution directly to discuss securing your accounts and any additional precautions that may be necessary. Report unauthorized transactions immediately.
• Remain vigilant over time. Personal information obtained through a data breach may be retained, shared or used in future fraud attempts. Criminals do not necessarily act immediately following a breach, and individuals should continue monitoring their accounts and remain cautious of suspicious communications.