EQC’s handling of privacy breach “absolutely appalling”

EQC has today made contact with homeowners (via email) after accidentally releasing confidential details of 8000 insurance claims on May 26.

Last week, Chief Executive Officer Sid Miller said a staff member “failed to follow several key security steps, including well-established password protection of the documents, despite receiving the appropriate training.”

Mr Miller said he felt “embarrassed and frustrated as his team had worked hard to put new systems and security measures in place after a similar earlier incident.”

But many claimants are questioning why it has taken 10 days to hear from the Commission.

Insurance Claimant Advocate, Ali Jones says “the common response I have had from those affected is, why has it taken so long for EQC to make contact with claimants? And I think that’s a fair question. It would also be good to know where the information is now?”

The email from EQC’s Chief Executive, Sid Miller, says “The customer and lawyer who received the information were contacted immediately and we are working to ensure that the information is destroyed.”

Ali Jones says “this is a great deal of personal information about a very large number of people and their claims. I am sure some claimants are quite stressed about where that information is, and I think EQC should be clearer about that and what they are doing to sort the situation.”

One claimant, who has battled with EQC for seven years before her claim was put over cap, says she is appalled by the time it has taken EQC to contact people who had their information leaked.

She heard about the security breach on the radio in late May and assumed their details weren’t a part of the 8000 because they hadn’t been contacted – until today.

“Over the past fortnight, EQC has not only spoken to media, they have contacted the Privacy Commissioner. I am incredibly disappointed that notifying those of us whose privacy was breached was not higher up their priority list,” she says.”

The claimant says she’s actually less worried about the breach itself and hopes the poor staff member is being supported.

“Mistakes are made and no one is infallible but why has it taken EQC so long to contact us? I am not surprised but am deeply disappointed that EQC is continuing to put communicating with those impacted by their failings at the bottom of their priority list.”

“It has been nearly 10 years since the 4 September earthquake, EQC’s communications issues should have been fixed by now.”

EMAIL SENT TO A CLAIMANT TODAY

The email sent to claimants today:

Claim Number: CLMXXXXXXXX

4th June 2020

Sent by email to: XXXXXXXX

 Dear XXXXXX

On 21 May 2020 a staff member unintentionally sent a spreadsheet to a customer and their lawyer containing information regarding approximately 8000 EQC customers’ claims. Unfortunately your claim details were included.

 Please accept my sincere apologies for this error. EQC has made a concerted effort to make sure customer information is as secure as possible and increased the level of security checks, but regrettably this mistake has still occurred, and I apologise to you for this.

 The spreadsheet contained the following information fields: claim number, name, address, private insurance company, EQC cap amount, apportionment and amount paid/estimated.

 As soon as we became aware of the breach, we took prompt steps to rectify the error and notified the Office of the Privacy Commissioner. The customer and lawyer who received the information were contacted immediately and we are working to ensure that the information is destroyed.

 EQC takes the security of its customers’ information extremely seriously as we handle thousands of documents and files each year. We continue to strengthen our training and processes for keeping information secure as well as maintaining a high staff awareness. Additional measures have been put in place since the breach including, management of emails and documents, and additional quality checking.

 We follow the guidance provided by the Office of the Privacy Commissioner, their website www.privacy.org.nz provides information which may be of help if you are concerned about what steps, if any, you may want to consider in response to the breach.

 Further InformationIf you require further information or wish to make a formal complaint to EQC about the breach, please phone 0800 DAMAGE (0800 326 243) between 7am-9pm Monday-Friday or email us at [email protected]