Calgary third-party vaccination verification app pulls web portal after users' data left unsecured
A third-party vaccine verification app that was initially endorsed by the Calgary Flames' ownership group left some users' data unsecured and available to be viewed by the public, CTV News has confirmed.
The website app of Calgary-made PORTpass was pulled offline late Monday and its website now says "we are updating" on its landing page.
A news tip sent to CTV News and other media outlets on Monday evening pointed out the security flaw that allowed anyone to access profile information of PORTpass users.
The pages displayed the name, email address, blood type, postal code, date of birth and phone number of registered PORTpass users. The page also contained a link to the photo identification submitted by a user, including their driver's licence or passport.
FLAMES FANS: BRING HARD COPIES
Calgary Sports and Entertainment Corporation (CSEC) -- the group that owns the Flames, Stampeders, Roughnecks and Hitmen -- had initially encouraged fans to download PORTpass to provide easier entry into the Saddledome.
CSEC is now saying fans should bring hard copies of their vaccination records to future games.
"CSEC is reviewing issues that have arisen with respect to the use of the PORTpass app and will release further information as appropriate," a statement on the Flames' website reads.
PORTpass CEO Zakir Hussein says he ordered his team to take down their web portal Monday after he found out that user information was publicly available online.
"I'm waiting to hear back from our audit teams here to make sure... where are we going wrong? Where are these holes? What needs to get fixed?" Hussein said Tuesday.
He added that he has two companies auditing the PORTpass security and privacy systems and he is unsure of how many user profiles were affected by the breach.
"Personally, I don't know. I don't yet, but it was definitely not in the hundreds of thousands or thousands or five hundred," he said.
CTV News is unable to verify how many user profiles were affected and for how long their personal information would have been available publicly online.
"We are working on figuring out exactly what happened here and obviously we're going to make this better," Hussein said.
Alberta's Office of the Information and Privacy Commissioner of Alberta said it is contacting PORTpass to remind them about reporting its privacy breach.
"Under Alberta’s Personal Information Protection Act (private sector privacy law), if an organization experiences a breach and determines that there is a real risk of significant harm to affected individuals, it must report the incident to the Commissioner and notify affected individuals," reads a statement from the province's privacy commissioner.
CTVNews.ca Top Stories
Spectacular aurora light show to be seen across Canada Friday night
A rare and severe solar storm is expected to bring spectacular displays of the northern lights, also known as aurora borealis, across much of Canada and parts of the United States on Friday night.
'Tactical evacuations' underway near Fort Nelson, B.C., as wildfires encroach
The BC Wildfire Service says 'tactical evacuations' began Friday near Fort Nelson, B.C., due to an out-of-control wildfire that has grown rapidly since it was discovered earlier in the afternoon.
Snowbirds in Vancouver for puck-drop flyby as Canucks face Oilers
The Canadian Forces Snowbirds will be performing a flyover across downtown Vancouver at the start of tonight's Stanley Cup playoff game between the Canucks and the Edmonton Oilers.
McGill University seeks emergency injunction to dismantle pro-Palestinian encampment
McGill University has filed a request for an injunction to have the pro-Palestinian encampment removed from its campus.
Which Canadian cities have the highest and lowest grocery prices?
Where you live plays a big factor in what you pay at the grocery store. And while it's no secret the same item may have a different price depending on the store, city or province, we wanted to see just how big the differences are, and why.
Swarm of 20,000 bees gather around woman’s car west of Toronto
A swarm of roughly 20,000 bees gathered around a woman’s car in the parking lot of Burlington Centre.
Barron Trump declines to serve as an RNC delegate
Former U.S. President Donald Trump's youngest son, Barron Trump, has declined to serve as a delegate at this summer’s Republican National Convention, according to a senior Trump campaign adviser and a statement from Melania Trump's office.
U.S. says Israel's use of U.S. arms likely violated international law, but evidence is incomplete
The Biden administration said Israel's use of U.S.-provided weapons in Gaza likely violated international humanitarian law but wartime conditions prevented U.S. officials from determining that for certain in specific airstrikes.
'State or state-sponsored actor' believed to be behind B.C. government hacks
The head of British Columbia’s civil service has revealed that a “state or state-sponsored actor” is behind multiple cyber-security incidents against provincial government networks.