Data breach leads to leak of City of Yellowknife staff emails

Emails sent and received by senior City of Yellowknife staff and city council members have been compromised after an apparent data breach, CBC News has learned.

The emails were taken by a City of Yellowknife employee in late 2016. The employee, who CBC has agreed not to identify for fear of reprisal, took the documents after becoming frustrated with what they characterized as a lack of internal and external transparency at the city's administrative level.

The employee said that they believed a distorted flow of information from members of administration to the mayor and city council had limited the ability of council to make proper decisions on issues within the city.

According to the employee, the breach includes emails by senior city staff and council over a number of years.

CBC has viewed some of the emails. The emails seen by CBC appear to encompass every message sent by a member of senior city administration from their work email address over a number of months in 2014.

The emails viewed by CBC include conversations between senior administration, staff, and members of city council. Most are regarding the day to day operations of the city.

Some of the emails discuss highly sensitive issues, including personnel matters. Some indicate senior staff's frustration with public criticism from members of the current council at the time.

A Yellowknife resident, who CBC has agreed not to name for fear of reprisal, said they brought the data breach to the attention of city administration in the spring of 2017.

In an email, city councillor Steve Payne said that as of October 1, he had not been advised by administration that his emails may have been compromised.

"I have heard rumors there was a leak," he wrote. "It's disturbing that something like this could happen."

Several other city councillors declined comment.

The City of Yellowknife did not provide comment ahead of publication. 

However, an emailed statement sent Oct. 16, three days after this story was first published, reads "Information Technology (IT) security breaches are a serious concern for any organization, including the City."

"The City's IT division is constantly monitoring for breaches and attempted hacks/viruses, which are becoming more and more sophisticated. If it becomes evident that the City's system has been hacked then this would be a matter of investigation for the RCMP as the city takes its responsibility of handling and managing the personal information of our staff and citizens very seriously."

Got a tip for CBC North? Reach northinvestigates@cbc.ca