December 3rd Theft

Details surrounding the theft that occurred

What Happened?

At 3:30 am December 3rd, 2023, Salal’s new (under construction) office site was broken into, and technology hardware required for service delivery and operations was stolen.  One of the hardware items that was stolen was a copy of our back-up server.

The break-in that occurred is still an active investigation. We are cooperating with the Vancouver Police Department and engaging our landlord, the City of Vancouver, to mitigate risk and prevent further theft; including sharing video footage secured of the person who stole our hardware and broke into other units in the building on the same night. In what has been revealed to us so far is this was a theft of hardware and not a targeted attack on our data.

We immediately completed a full privacy assessment for us to understand the risks to privacy for those directly impacted. We have also been working with IT experts who informed us that moderate to high knowledge and IT skills of how to route the information and find it in the drive would be required to access any information held on the drive.

As this is an active investigation, we do not want to increase risk of a data breach by giving the perpetrator more information about the nature of our hardware, nor how to access the data. We continue to work with our IT team and a privacy lawyer as part of our internal investigation into the theft and to ensure we are following privacy laws and serving our community as best as we can during this difficult time.

We know this can have a big impact 

We want to acknowledge and affirm the distressing nature of this news for survivors and our community, including you. We know that violations of safety, transgressions against our autonomy, and invasions of privacy can be triggering. In addition to our accountability for this breach, we offer our full support of survivors who may be navigating overwhelming emotions because of it.

24-Hour Crisis & Information Line: 1-877-392-7583
Salal Connect Text and Chat Support: 604-245-2425  |  salalsvsc.ca/connect-chat

What This Means for Our Community

We’re not taking this theft lightly. While we do not believe that this break-in was targeted to destabilize Salal SVSC or the survivors that we serve we want to ensure that our community understands the steps we’ve taken since the events on December 3rd occurred as well as what else can be done to enhance your personal security.

What the data theft could mean for survivors and Salal donors

It is possible that your name, email address, telephone numbers, and notes about safety risks or what services you have requested, could be released, sold, and shared publicly. 

We think it is a low possibility that the thief will be able to get into the computer equipment they have stolen and get access to the particular file that has your identifying information on it, yet that doesn’t change the risk to your privacy which we take very seriously.

We have conducted a privacy impact assessment on the incident and the risk to your privacy is moderate. We are of course very  concerned with ANY possible data breach, even if the possibility is moderate, and we are doing everything we can to make sure that this cannot happen again.

Client files that include case notes are stored on the Jane App and donor files that hold such information as debit and credit card numbers information are stored on Blackbaud Raiser’s Edge. These are both encrypted and not at risk through this theft.

What steps have we taken to increase security to our space and data?

Salal is working closely with Vancouver Community Network (VCN), our contracted, third party tech company to investigate the full scope of the data loss and support us to be even more well-secured should we encounter another break-in. We additionally have been migrating our data to an encrypted cloud server.

Since December 3rd we have also taken the following steps to increase the security to our space and our data.

  • Made a police report
  • Alerted our landlord at the City of Vancouver and other tenants in the building
  • Reviewed security camera footage to identify the person that gained access to our space
  • Have added cameras to the space and specifically focused on our IT room
  • Reinforced all access points with additional layers of security (metal plates over the locks and reprogramming of all FOBs that can access our space)
  • Our IT provider encrypted the data on our server and set-up an encrypted cloud-based back up system
  • Migrated our back-up server to an encrypted cloud server
  • Created an internal plan to add additional layers of safety to our server (encryption and password protection)
  • Are in process of communicating with all stakeholders impacted by the data loss
What steps can you take to secure your information?
  • Steps you can take as an individual to increase protection from potential harm from the breach are to change all your passwords for accounts that hold sensitive information (banking, CRA, email account that you used at Salal), install a two factor authentication on your bank accounts and CRA account
  • Use websites like https://haveibeenpwned.com/ to see if your email shows up as one that has been compromised in a data breach; this will cover any data breach your email has been involved in. If your email has been part of a breach it doesn’t necessarily mean it is from this incident. 
  • You should remain vigilant about suspicious activity and check your credit reports, as well as your other account statements, periodically over the next 12 to 36 months. You should immediately report any suspicious activity to the credit bureaus.
  • Please be on alert for spamming for phishing emails or text messages from our organization. We will never ask for personal or banking information over email or text. If you are unsure if the email you have received is authentic, please call our office line. 

We have been transparent with our direct community including the survivors we serve, our donors, past staff/volunteers/board members, and contractors by informing them directly about this theft of hardware. Below are emails that were sent last month. If you are a survivor that is accessing or has accessed Salal’s services or are a donor, we recommend reading the email for more information.

Email to Survivors
Email to Donors

“Having our new office broken into, and this theft occurring, has been devastating to us as an organization and to our team. Our deepest commitment is to survivors and our community, and we know this has, and will have, a significant impact on them. Our goal in communicating about the break-in is to provide our community with information, tools and resources and includes our commitment to mitigate further harm.”

Dalya Israel, Executive Director
Salal Sexual Violence Support Centre

Official Privacy Page Coming Soon