LCBO suffers third-party data breach compromising information of some customers

The Liquor Control Board of Ontario (LCBO) said Wednesday that personal data of some customers has been compromised in a data breach involving a third party – primarily first name and email address, of certain LCBO email subscribers.

In an emailed statement, an LCBO spokesperson said that the company was notified by Conversion Digital, a third-party service provider used to send LCBO promotional emails, that an unauthorized party obtained access to data that included the personal information of some LCBO subscribers.

The liquour store clarified that passwords and financial details – including credit and debit card information – were not involved in the leak.

“No password or financial information was involved in this incident. This incident is limited to LCBO email subscribers,” the statement added.

This is the second data breach incident to hit the provincial Crown corporation this year. In January, LCBO said that an unauthorized party embedded “malicious code” on company website to gather customer information.

The recent data breach includes first names and emails – however, other information provided when signing up for promotional emails, including date of birth, postal code, and Aeroplan number, may also have been affected.

As a government agency, LCBO is accountable to the Legislative Assembly through the minister of finance. As a result, the company said the Office of the Information and Privacy Commissioner of Ontario has been notified.

The LCBO is pausing promotional emails while a third-party investigation takes place.

Rahat Sandhu