Last week we wrote about courts and AI vendors. This week the lesson is older and quieter: some of the biggest privacy incidents come from data nobody remembered they still had. A 2011 file on Prince Edward Island, legacy systems at a major health software vendor, and firewalls taken over with ordinary stolen logins all point the same way. Add Canada's lawful access bill heading through the Senate and a stat about AI agents knocking on Canadian government doors, and there's plenty to get through. Let's get into it.
🗞️ STORY OF THE WEEK
A 15 Year Old File Could Expose 234,000 Islanders’ Health Card Data
Health PEI reported this week that about 234,000 people may be affected by a breach involving a file from 2011 that contained health card information. That is a large share of a province's population, and the data at the centre of it is old enough that most people would assume it had long since been cleaned up.
That is the uncomfortable part of this story. Nothing about it requires a clever new attack. A forgotten data store, kept long past its useful life, quietly became the source of a major privacy incident. Organizations tend to invest in protecting what they actively use and overlook what they merely still have.
It is also not an isolated pattern this week. Nearly 20 million people's personal and medical data was reportedly exposed through legacy systems at Oracle Health, according to a US state filing. Different organizations, different countries, same root cause: old systems and old files that stayed around because deleting them was never anyone's job.
Why It Matters
Under PIPEDA and provincial privacy laws, your business remains responsible for personal information it holds, including information it no longer needs. Ask yourself: do you know what customer or employee records are sitting in old systems, old email, or old shared drives, and why you are still keeping them?
What Can You Do
Pick one place where old records pile up, such as a shared drive, an old accounting system, or archived email, and ask who still needs what is in it. If nobody does, work with your IT provider to securely delete it or move it somewhere locked down. Data you no longer have cannot be breached.
⚡THE RIPPLE EFFECT - Three stories, and what they actually mean for your business
Nearly 20 Million People’s Health Data Reportedly Exposed Through Old Oracle Systems.
Personal and medical data of nearly 20 million people was reportedly compromised in an attack on legacy Cerner systems now owned by Oracle Health, based on a filing with the Texas attorney general cited by Bloomberg. Oracle has not publicly confirmed the total, and the figure comes from US regulator filings.
What it means for you: If your business uses a vendor that holds sensitive records, ask which older platforms they still run and how quickly they would tell you about a breach. Your vendor's old system can quickly become your problem.
Attackers Are Locking Businesses Out of Their Own Fortinet Firewalls
A campaign called FortiBleed has taken over roughly 86,600 Fortinet firewall and VPN devices in 194 countries, according to security firm SOCRadar. Attackers get in with stolen or guessed logins, and some victims have been locked out when the attackers change passwords or delete accounts. The FBI and US Secret Service advise resetting all VPN and admin passwords and using multi factor authentication that resists phishing.
What it means for you: If your business uses Fortinet equipment, ask your IT provider this week to check for admin accounts nobody recognizes, reset VPN and admin passwords, and confirm multi factor authentication is on for remote access.
Canada's Lawful Access Bill Is Now Before the Senate
Bill C-22, the Lawful Access Act, passed the House of Commons on June 18 and reached second reading debate in the Senate on October 8. As described by law firms and commentators, it would let police ask telecommunications providers to confirm whether someone under suspicion is a customer without first getting a warrant, and would require electronic service providers to help supply data when asked. Tech companies and privacy advocates argue parts of it could weaken encryption. The bill is not law yet, and Senate amendments are possible.
What it means for you: If your business stores customer data or provides online services, this bill could shape how you handle police requests. Ask your IT or legal advisor who in your business would receive such a request and what the process is, before one arrives.
200,000+
Autonomous AI agents sent more than 200,000 requests, including basic probing for website weaknesses, at the US Department of Education and Library and Archives Canada between April and June 2026. Officials report no access to non public information. Last time we covered this same research lab's findings about agents probing Australian government sites; this adds a Canadian target.
✅ ONE THING TO DO THIS WEEK
Write Down Every AI Tool Your Business Uses
With Ottawa's new AI council and a House committee both looking at AI rules, the direction is clear: businesses will be asked what AI they use and what it touches. The easiest time to answer that is before anyone asks.
Open a blank document and list each AI tool in use, including chatbots, writing assistants, meeting note takers and anything staff signed up for on their own. Next to each, note what information goes into it and who in your business approved it. One page is plenty. Review it every quarter.
The easiest time to answer “What AI do you use?” is before anyone asks.
📌 QUICK BITES
A critical flaw in Fortinet's FortiMail email security product is being exploited. It lets an attacker write files onto the device without logging in. Security tools are themselves targets, so if your email gateway is FortiMail, ask your IT provider about mitigations now.
Prime Minister Carney announced a National Council on Artificial Intelligence on October 2. Details on its mandate are still emerging, and a House of Commons committee began studying AI regulation on October 5. Expect clearer federal expectations on AI use before long.
Anthropic launched a three tier cyber verification program for its AI tools. Defence, red team and specialized tiers require identity verification and data retention to monitor misuse. Expect AI vendors to attach similar conditions to powerful features.
Canada's Bill C-8, the Critical Cyber Systems Protection Act, has passed and received royal assent. It places cyber security duties on designated operators in critical sectors like telecom, energy, finance and transport. If you supply to those sectors, expect customers to start asking about your security.
💬 PARTING THOUGHT
Most of us picture a cyber incident as something new and sophisticated. This week's stories suggest the opposite: a 2011 file, legacy health systems, ordinary stolen passwords. The danger is often in what we already have and stopped looking at.
That is good news in a way, because the fix is rarely exotic. It is a clean up, a reset, a list on a page. Small, unglamorous jobs that fit into a quiet Friday afternoon.
Resilience is mostly housekeeping done on purpose.
See you next Friday and stay
TryberResilient