Investigation into Agronomy’s privacy practices related to safeguards, accountability valid consent for the collection and use of personal information

Description of the Breach

9. In early April 2020, the threat actor was able to use valid credentials to gain access to an administrator account on Agronomy’s systems, which the threat actor then used to successfully initiate a remote desktop connection to a workstation belonging to an Agromat member company. Agronomy represented to our Office that it was unable to determine how the threat actors had obtained the credentials that they had used to gain access. We note that there a variety of avenues that can be used to obtain such credentials, including social engineering^{Footnote 4} techniques such as phishing^{Footnote 5}, as well as credential stuffing^{Footnote 6}, malware^{Footnote 7}, insider threat^{Footnote 8} and many other tactics. In the matter at hand, Agronomy advised that no evidence of employee involvement in the incident was found, indicating that the threat actor had stolen the credentials. Our Office notes that administrator accounts are particularly valuable targets given the ability for a threat actor to leverage elevated privileges associated with such accounts to expand access and assume control of an entire system.
10. In May, the threat actor attempted to use their access to the system to access corporate bank accounts and purchase bitcoin, but they were ultimately unsuccessful in doing so. The threat actor then took advantage of the amalgamated design of Agronomy’s systems to move laterally through the network and take control of additional systems in the Agronomy network environment. Between May 18 and May 27, 2020, the threat actor used their control over Agronomy systems to exfiltrate data from shared folders, ranging from corporate communications and records to customer databases. They then deployed ransomware on May 27, 2020, encrypting the contents of the system and blocking legitimate access. It is only at this point that Agronomy became aware of the attack. This delay in detection likely contributed to the threat actor’s success in erasing system logs, given that they were able to complete all activities and exfiltration, and then remove all traces of that work prior to deploying ransomware.
11. Upon realizing that its systems had been compromised, Agronomy commenced assembly of an incident response team including third-party security specialists, and referred the matter to law enforcement. The incident response team was fully assembled, with additional resources, in the following days. Subsequent to the ransomware deployment, the threat actor contacted Agronomy by email and demanded a ransom in exchange for decryption keys for their system, providing sample files to prove the successful exfiltration of data. Agronomy refused to pay the ransom, and based on the sample files provided, identified two affected individuals. Agronomy represented that Agromat members took steps to notify these two individuals of the breach on June 5, 2020. Agronomy notified our Office of the breach and the 2 affected individuals on June 8, 2020.
12. On June 2, 2020, following Agronomy’s failure to pay the demanded ransom, the threat actor initiated an “auction” of the entirety of the exfiltrated data on a digital marketplace that it had created. The auction remained open for a week. The threat actors made a number of posts on twitter with regard to the auction, making Agronomy aware that it was taking place. For several days during this period, until Agronomy’s systems were secured by third-party experts, the threat actor continued to publish excerpts from Agronomy’s corporate communications regarding the company’s attempts to address the breach. The threat actor subsequently released the exfiltrated files to the dark web. With the assistance of its third-party experts, Agronomy was able to obtain a copy of the breached dataset and hired a third-party e-discovery^{Footnote 9} service provider to analyse the data and determine the affected parties.
13. Agronomy represented that Agromat member companies sent notifications to affected individuals over a period beginning June 5, 2020 and ending February 17, 2021. Agromat members sent new notifications as they became aware of affected individuals through the progressing e-discovery process. The complainant in this matter was sent a notification from [the vendor] by mail [in July 2020], and received it in [the same month]. Agronomy sent our Office incremental updates on the breach, with the number of affected individuals growing steadily over several months from the initial figure of 2, to the final number of 845.           

Personal Information involved in the breach

14. As noted above, Agronomy ultimately determined that the threat actors had obtained the personal information of 845 individuals. These individuals were clients of various Agromat Group companies, including [the vendor], whose personal information was stored on Agronomy’s systems. The compromised personal information included information collected from Agromat account applications, and included, depending on the individual: social insurance number (“SIN”), date of birth (“DOB”), driver’s license number, name, address, phone number, bank account number and name of financial institution, credit card information, passport information, information on salary or pension, e-mail address, and electronic signature.

Sensitivity of Personal Information

18. The compromised personal information included a variety of biographical and financial details as well as SIN, which is particularly sensitive, given its permanence and importance for establishing identity and functioning in Canadian society. Our Office notes that information such as this can be used by malicious actors to perpetrate identity theft. Additionally, we note that in certain cases, bank account information and credit card numbers were also compromised, potentially enabling financial fraud.
19. Given the sensitivity and associated risks outlined above, the security safeguards implemented by Agronomyto protect this personal information should have been commensurately strong.
20. The complainant has alleged that [they were] the victim of financial fraud as a result of the breach. The respondent denies this allegation. It was not within the scope of our investigation to determine this issue.
21. Agronomy has advised that aside from the complainant, no other individuals have contacted them, either to complain about the breach or report losses.

Technical Safeguards

22. With respect to technical safeguards, our Office found a number of significant gaps in relation to Agronomy’s breach prevention and response. Certain of these gaps contributed directly to the occurrence and severity of the breach in question. Specifically: (i) Agronomy did not employ multifactor authentication, which facilitated the threat actor’s ability to gain access to the system with stolen credentials; (ii) after gaining access to the network, the threat actor was able to move around freely due to a lack of segregation in Agronomy’s network architecture; (iii) the threat actor was able to read the data that they accessed across the network as it was not encrypted; and (iv) due to a lack of detection and response tools, the threat actor was able to access the network, exfiltrate data and cover their tracks, without being detected for approximately two months.
23. Agronomy did not utilize multifactor authentication for employee access to its systems, which allowed the threat actor to use stolen credentials to obtain full administrative access to the respondent’s systems. Multifactor authentication is widely recognized as a security best practice – even more so in the case of accounts with broad administrative authority with access to highly sensitive information. If multifactor authentication had been in place, then simply knowing the administrator’s password would not have been enough to gain access to the account. The threat actor would have needed a second factor such as something that the administrator “had”, like a phone or USB key, or something the administrator “was”, like a biometric print.
24. The severity of the attack was exacerbated by the lack of segregation in Agronomy’s network architecture. Agronomy had linked multiple Agromat systems together, even though this was unnecessary, which allowed the threat actor to take advantage of lateral movement to compromise and take over multiple systems in the Agromat corporate network. It is a best practice to link only necessary workstations and systems together in a network to minimize the harm that can be caused by lateral movement. Had the networks of various Agromat retailers been segregated, the impact of the breach may have been significantly diminished, as the threat actor would likely only have been able to assume control of one of the Agromat retailers’ systems.
25. Agronomy did not utilize encryption to secure its database or data. It stored sensitive personal information in shared folders that were widely accessible to employees. Agronomy represented that as the threat actor had access to an administrator account, encryption would not have prevented the malicious actions taken. We note, however, that various levels of administrative privilege can exist, and an administrator does not necessarily need to have access to all encryption keys. It is generally a good security practice to segment access and permissions to minimize the impact of any one account being compromised. In any event, setting the specific incident aside, the lack of encryption coupled with lax data storage practices (discussed below in paragraphs 36 and 37), rendered Agronomy’s data susceptible to compromise in a wide variety of scenarios, and thus represented a critical vulnerability. Encryption of corporate data is a standard best practice, and in the case at hand, where the records included sensitive personal information, we would have expected encryption to be in place.
26. Agronomy also lacked adequate attack detection and response tools. A lack of tools to provide alerts in the face of suspicious behaviour can allow threat actors to go undetected until serious harm has been done. More specifically, Agronomy did not have adequate logging and alerting tools, such as a Security Information and Event Management (SIEM)^{Footnote 10} solution. Nor did it have a detection or response tool such as an Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) product.^{Footnote 11}
    1. A properly configured SIEM is able to aggregate and analyze data from a variety of sources from across an enterprise network, and when equipped with proper rules for detecting suspicious behaviour, can provide alerts to staff and in turn, enable mitigation and response. A SIEM solution provides wide coverage by analyzing millions of events and identifying attacks, some of which a single security tool may miss.
    2. An EDR or XDR provides centralized monitoring, detection and response capabilities to endpoint devices such as workstation computers, servers and phones – a vulnerable part of the network.
    While a SIEM and/or EDR/XDR are not specifically necessary in every case, we would have expected Agronomy to have implemented some form of properly configured alerting and response tools in a system where highly sensitive personal information was being stored.

27. At the time of the incident, Agronomy relied on logs from its firewall hardware and operating system for monitoring and detection. The firewall did log a number of actions conducted by the threat actor. A review of the logs provided to our Office by the respondent revealed account behaviour and access patterns that could have been flagged as suspicious. However, in the absence of a detection and response solution, none of these actions resulted in alerts to staff – these actions were not identified as suspicious until the post-incident investigation by third-party experts.
28. The result in this case was that the threat actor was able to exploit undetected access to Agronomy’s systems for approximately two months to further their control over the entire system and cover their tracks by deleting a variety of logs and backups. Agronomy did not discover the intrusion or compromise until the threat actor deployed ransomware to encrypt and lock its systems. Had Agronomy implemented properly configured detection and response tools, the incident may have been identified within hours or at most days, potentially preventing or significantly mitigating the exfiltration of customer data.
29. We also identified further safeguard gaps that, while not linked directly to the breach, represented a failure by the respondent to adequately safeguard the sensitive information under its control.
30. With regard to attack prevention, while Agronomy had a firewall and antivirus solution in place, it lacked a Web application firewall^{Footnote 12} and could not provide any information on steps it had taken to harden^{Footnote 13} its servers, measures we would have expected, in accordance with standard practices.
31. Agronomy also lacked a patch management policy or protocol, to promptly install available software updates with a view to protecting against known vulnerabilities. The company represented that patching had been proceeding in an ad-hoc manner. Agronomy had been working towards applying operating system updates to workstations and servers, but not all systems had been updated. While the evidence suggests that out-of-date software was not directly responsible for the breach in this case, failure to patch systems and keep them up to date is a significant risk that can cause or aggravate breaches. Once malicious actors are aware of a vulnerability for which a patch has been created, they will quickly seek out opportunities to exploit the vulnerability in systems that have not yet been patched. It is therefore of utmost importance to have a protocol in place to ensure that patches are implemented on an expedited basis, as soon as they are made available.

Organizational Safeguards

32. In addition to the deficiencies that we identified in Agronomy’s technical safeguards, our Office also found significant gaps with respect to the company’s safeguard practices and policies.
33. First, Agronomy did not have incident response protocols for responding to a cyberattack.
34. In this case, we recognize that Agronomy did take steps to respond after discovering the breach, including to deploy a response team and seek internal and external expert assistance. Further, an incident response plan may not have materially improved the outcome in this case, given the respondent’s failure to detect the threat actor’s intrusion for approximately two months, until ransomware had already been deployed (at which point, most of the harm was already done).
35. That said, had Agronomy implemented appropriate tools to detect and alert them of the breach sooner, a proper incident response protocol could have assisted in further mitigating the harms of the breach. Moreover, as explained in paragraph 12, the threat actor continued to acquire and publish Agronomy’s confidential communications even after the deployment of ransomware alerted Agronomy to a breach. Agronomy explained that while its executives were communicating on an affiliated company’s network, which had not been compromised, one Executive involved in the discussion had email forwarding in place, which was sending emails to the compromised system. Proper incident response protocols would likely have addressed and therefore prevented this type of behaviour and could have allowed the network to be secured more expeditiously. In general, preparation and planning for cyber incidents is an important safeguard in and of itself, where responding immediately to an incident is often critical to assessing, managing and mitigating harm associated with a discovered breach.
36. Agronomy also lacked proper information management and data storage practices to ensure the secure storage of the sensitive personal information of its customers. Rather than storing personal information in a secure database or repository, Agronomy employees had saved the highly sensitive personal information of the 845 affected individuals in various shared folders, labelled as “miscellaneous documents”, across its network.
37. This gap in information management contributed to Agronomy’s delay in identifying affected individuals. Agronomy lacked knowledge of and familiarity with its own data storage practices, and rules for the storage of customer data on its servers. This resulted in significant delays, such that Agronomy identified affected individuals in a staggered fashion over the course of 7 months through third-party e-discovery of the breached dataset. Seeking expert support to confirm the affected individuals and data was a positive step, but the e-discovery expert’s identification of affected individuals would likely have been accelerated if Agronomy had had appropriate information management and storage rules in place.
38. Ultimately, Agronomy had a general lack of security-related documentation and records. As a result of limited or incomplete documentation and records with respect to the organization’s past safeguard practices, there were many basic questions that Agronomy was unable to answer, thus diminishing our ability to assess Agronomy’s complete security safeguard infrastructure. Agronomy explained that there had been a change in its entire IT team and much of its IT infrastructure since the breach. Staff turnover and infrastructure changes are to be expected over time. However, adequate recordkeeping and documentation related to safeguards and the breach would have allowed Agronomy to better answer our questions, and to maintain corporate knowledge that could assist the company in avoiding similar safeguard weaknesses in future.
39. Similarly, Agronomy was unable to provide any documentation with respect to training for IT and other staff. The respondent was also unable to confirm whether any IT training had been provided to its staff. We note that given the fast-paced nature of IT security, ongoing training, particularly in cybersecurity, is critical to ensuring that key safeguards are in place and properly configured.
40. This highlights the importance for organizations to ensure that documented policies and record-keeping practices are in place to properly evaluate, manage, track and demonstrate the implementation of adequate safeguards in compliance with PIPEDA.

Assessment of Agronomy’s Safeguards before and after the Breach

41. We find that the specific weaknesses described above constitute a failure by Agronomy to implement security safeguards appropriate to the sensitivity of the personal information held by the company, in contravention of Principle 4.7 of the Act.
42. We recognize that not all SMEs will have the capacity to maintain, in-house, the diverse expertise necessary to ensure adequate technical safeguards, information management and breach response protocols and associated training in a dynamic threat environment. However, there are a variety of third-party service providers and automated tools that can be employed by SMEs to address gaps in safeguards and assist in fulfilling compliance requirements under the Act.

Actions taken by Agronomy since the Breach

43. We note that Agronomy has made a number of significant improvements to its overall security posture since the breach, including by contracting for third-party services that it may not have capacity to maintain in-house. These improvements have been guided by external experts as well as an entirely new internal IT team, and recommendations by our Office, as detailed further below.

Technical Safeguard Improvements                                                           

44. Agronomy has implemented multifactor authentication for all external services, infrastructure and administrative services, as well as many employee accounts. It has also moved its infrastructure to a third-party infrastructure-as-a-service (i.e., cloud) platform and implemented conditional access, based on employee need.
45. The respondent has implemented an enterprise password manager and enforced password policy to improve the strength and quality of passwords, which can protect against brute-force attacks^{Footnote 14} by threat actors attempting to gain systems access.
46. Agronomy completed a full review of its firewall and account configurations and implemented a new EDR and antivirus product.
47. It also implemented alerting functions and rulesets in its logging and monitoring tools for suspicious behaviour in administrative accounts.
48. Agronomy has changed its network architecture to remove connections between Agromat affiliate sites. As a result, an attack on one system will no longer affect the others.
49. It also implemented third-party patch management software, and configured automated patching to ensure software is kept up to date.
50. Since the breach, the respondent has implemented a Data Loss Prevention (DLP)^{Footnote 15} service to enhance security, including through encryption, and control of databases and files. A DLP can, for example, identify sensitive information that matches defined characteristics (such as a number with 9 digits, that resembles a SIN) and protect it from unauthorized access and exfiltration.

Organizational Safeguard Improvements

51. Agronomy now includes IT training in its employee development plan, to be delivered to all staff on an ongoing basis. Agronomy also provides cybersecurity training to staff. It has contracted with a third-party provider to deliver ongoing training and conduct phishing simulations, to assist employees in recognizing and protecting against phishing attacks.
52. Finally, in response to a recommendation by our Office, Agronomy agreed to implement protocols for incident management and zero-day^{Footnote 16}
53. As a result, we find this aspect of the complaint to be well-founded and conditionally resolved.