Residents who use the City of Victoria’s web services for pre-authorized payments are urged to monitor their bank accounts for unusual activity in the wake of a computer breach.

The breach to Victoria’s online payment system occurred July 22, the same day Oak Bay and at least five other municipalities in the Lower Mainland also had their websites hacked.

article continues below

Victoria city staff were notified of the problem on Friday — 11 days after the incident occurred — but mayor and council were not told of it until Tuesday.

Oak Bay notified its residents of the breach on Friday, the same day it learned about it.

“We have no reason to believe anyone’s personal information has been compromised, but the city is endeavouring to proactively keep residents informed as they proceed with this investigation,” Victoria Mayor Dean Fortin said Tuesday.

There are about 6,500 residents who pay their taxes online, Fortin said.

Online payment users who have signed up for pre-authorized withdrawals to pay their city taxes and utilities are the only potentially affected users, the city said. The type of information that was available during the breach includes bank account numbers, names and addresses — the same information found on cheques.

The problem stemmed from a vulnerability in the payment system manufacturer’s software and not a weakness in the city’s security, said a statement released by Victoria.

Once the vulnerability was detected, a patch was applied to prevent further unauthorized access. City staff have set up a replacement computer server to protect pre-authorized transactions from further breaches.

Still, users are asked to monitor their bank accounts and change their passwords on the municipal server and any other services that use the same password.

Fortin said the city is doing a “quick investigation” of the software and servers used.

“Certainly, the City of Victoria has very high security systems in place — this one came through the software, and was not something we could see or control,” Fortin said.

smcculloch@timescolonist.com