Calgary third-party vaccination verification app pulls web portal after users' data left unsecured
A third-party vaccine verification app that was initially endorsed by the Calgary Flames' ownership group left some users' data unsecured and available to be viewed by the public, CTV News has confirmed.
The website app of Calgary-made PORTpass was pulled offline late Monday and its website now says "we are updating" on its landing page.
A news tip sent to CTV News and other media outlets on Monday evening pointed out the security flaw that allowed anyone to access profile information of PORTpass users.
The pages displayed the name, email address, blood type, postal code, date of birth and phone number of registered PORTpass users. The page also contained a link to the photo identification submitted by a user, including their driver's licence or passport.
FLAMES FANS: BRING HARD COPIES
Calgary Sports and Entertainment Corporation (CSEC) -- the group that owns the Flames, Stampeders, Roughnecks and Hitmen -- had initially encouraged fans to download PORTpass to provide easier entry into the Saddledome.
CSEC is now saying fans should bring hard copies of their vaccination records to future games.
"CSEC is reviewing issues that have arisen with respect to the use of the PORTpass app and will release further information as appropriate," a statement on the Flames' website reads.
PORTpass CEO Zakir Hussein says he ordered his team to take down their web portal Monday after he found out that user information was publicly available online.
"I'm waiting to hear back from our audit teams here to make sure... where are we going wrong? Where are these holes? What needs to get fixed?" Hussein said Tuesday.
He added that he has two companies auditing the PORTpass security and privacy systems and he is unsure of how many user profiles were affected by the breach.
"Personally, I don't know. I don't yet, but it was definitely not in the hundreds of thousands or thousands or five hundred," he said.
CTV News is unable to verify how many user profiles were affected and for how long their personal information would have been available publicly online.
"We are working on figuring out exactly what happened here and obviously we're going to make this better," Hussein said.
Alberta's Office of the Information and Privacy Commissioner of Alberta said it is contacting PORTpass to remind them about reporting its privacy breach.
"Under Alberta’s Personal Information Protection Act (private sector privacy law), if an organization experiences a breach and determines that there is a real risk of significant harm to affected individuals, it must report the incident to the Commissioner and notify affected individuals," reads a statement from the province's privacy commissioner.
CTVNews.ca Top Stories
'The lost season': Winter comes to a close as Canada's warmest on record
The warmest winter on record could have far-reaching effects on everything from wildfire season to erosion, climatologists say, while offering a preview of what the season could resemble in the not-so-distant future unless steps are taken to cut greenhouse gas emissions.
Demand soars for solar eclipse glasses in Canada. Are they worth buying?
The demand for total solar eclipse glasses used to safely view the rare celestial event has been ramping up as sellers, along with astronomy and eye-care experts in Canada, warn that viewing the eclipse with the naked eye is dangerous.
Hertz CEO out following electric car 'horror show'
The company, which announced in January it was selling 20,000 of the electric vehicles in its fleet, or about a third of the EVs it owned, is now replacing the CEO who helped build up that fleet, giving it the company’s fifth boss in just four years.
NEW High thoughts: The habits of Canadian cannabis users are revealed in a new StatCan report
Statistics Canada has conducted a series of surveys to measure the impacts of legalized cannabis since the Cannabis Act took effect in 2018. The latest one, the 2023 National Cannabis Survey, sheds light on users' preferences and habits last year.
Freddie Mercury's home is on the market for first time since 1980 minus his 'exquisite clutter'
Freddie Mercury's sanctuary in London, where he lived the last decade of his life, is on sale for the first time in nearly half a century -- minus his "exquisite clutter."
NEW Where to watch the state funeral for former prime minister Brian Mulroney
A state funeral for former prime minister Brian Mulroney will be held in Montreal on March 23. CTV News will have live special coverage of his funeral service.
NDP motion regarding Palestinian statehood passes after major Liberal alterations
A motion from the federal New Democrats initially calling on Canada to recognize the 'State of Palestine' passed amid widespread acrimony on Monday, after the Liberals drastically altered its wording to see the government simply work towards that aim as part of a two-state solution.
Retired teacher pleads guilty to paying for sex with 15-year-old in Collingwood, Ont.
In a Barrie courtroom on Monday, a retired high school teacher from the Niagara Region pleaded guilty to sexual touching and obtaining sexual services from a 15-year-old boy in Collingwood in 2021.
Toronto family doctor who called patient's body 'perfect' suspended for 3 months: tribunal
A family doctor in Toronto has been suspended for three months after a disciplinary tribunal found that he failed to follow proper protocols while examining a patient's breasts and made inappropriate comments about her body.