'Added stressor to university life': University of Guelph student speaks out following data breach

A student at the University of Guelph is speaking out over what she's calling a lack of transparency following a data breach.

On Wednesday, the provider of the school's health, dental, and wellness benefits confirmed to CTV Kitchener they were informed of a data breach on Mar. 10, 2023.

Gallivan, the provider, say it happened at a third party security company that they use for file transfers.

U of G students were told about it in a recent email, which says students ID numbers, names, and dates of birth were involved.

U of G students notified of benefits data breach four months later.

"Four months is a long time to be left in the dark," said Cate Thompson, one of the students who was impacted by the breach. "I was mostly just upset that there seemed to be a lack of transparency with both the university and the insurance provider."

Thompson says she's frustrated it took over four months for students to be notified.

"It's a bit worrying seeing that maybe my student identification, name, date of birth, all of that has been compromised, said Thompson. "Then just putting it on the students to be responsible to check back on that and see what happens in the future.

"It's an added stressor to university life."

Thompson says she will not be using the credit monitoring offered by Gallivan, as it is only offered for a year period, which she says is not long enough to offer a sense of security.

"So, after that time period, you don't get any updates and that could be when something happens for fraudulent purposes," said Thompson.

Fuelling frustrations for Thompson is the fact that this scenario feels all too familiar.

"This has happened to me, I've been subject to the WRDSB speed data breach that occurred last year," said Thompson. "All of this really just continues to diminish my expectations of what the university will do."

In a statement sent to CTV News by Gallivan earlier this week, the company said in part: "We worked quickly to determine the quantity and type of data exposed. Limited student personal information was included and we are communicating with students who were impacted."

CTV News reached out again to Gallivan to find out why it took over four months for students to be notified about the breach, but they did not respond by air time.

Gallivan says they're not aware of any of the compromised data being misused and also noted this breach had impacted over 100 organizations worldwide.