On September 3, SNC-Lavalin identified a cyber security incident in which an unknown and unauthorized third party attempted to access user accounts and successfully gained temporary access to the mailbox of one employee. That email account contained personal information about current and former employees.
As soon as we discovered the unauthorized access, we acted immediately to restore security to the impacted account and initiated a comprehensive investigation.
Although we have evidence that the mailbox was accessed, we do not have evidence that any personal data was copied, but we can not exclude this possibility.
We regret that individuals may have been potentially affected by this incident.
The incident does not affect all former or current staff. We are notifying those current and former employees whose personal data we have been able to identify was within the relevant mailbox and providing them with access to resources to reduce the risk of potential impacts associated with this incident.
The investigation and outreach to those affected is ongoing. Any individual who isn’t a current employee, but who has provided personal and sensitive information (such as name, job role information, birth date, social insurance number/social security number/national insurance number, addresses, salary, personal financial information, ID cards, driver’s licences or passports) in an employment context to SNC-Lavalin, between 2013 and 2019, should contact us by one of the following means if they wish to confirm whether their personal data was impacted:
- Canada and United States of America: 1-833-451-8809, from 9:00 am to 5:00 pm EST, Monday to Friday.
- Other countries, Canada and United States: [email protected] or [email protected].
As part of our commitment to integrity and our obligations under the law, we have also notified appropriate privacy regulators. SNC-Lavalin values privacy and data security and takes this incident very seriously. In addition to security enhancements already implemented, SNC-Lavalin will continue to look for opportunities to further strengthen and enhance the company’s security infrastructure.