A class-action lawsuit was launched yesterday over a computer hard-disk drive that went missing from ISM Canada that included confidential data affecting more than one million people.

The suit, filed by a Regina law firm, is against ISM as well as several of its clients, including Investors Group Inc., Co-operators General Insurance Co., the Saskatchewan government and several Saskatchewan government agencies.

ISM, a subsidiary of Markham, Ont.-based IBM Canada Ltd., is one of Canada's largest providers of information management services for governments and private companies.

The disk went missing on Jan. 16 and ISM reported it as a theft to police.

The suit alleges the defendants violated customer privacy, and were negligent in securing confidential information and notifying the public about the lost disk.

The customers "have suffered significant loss and damages including personal injury and injury to their economic interests, all of which were foreseeable damage directly resulting from the loss and disclosure of the confidential information by the defendants," alleges the suit filed by Tony Merchant, whose firm, Merchant Law Group, is known for acting on behalf of thousands of former students of native residential schools.

ISM and Investors Group declined comment on the suit.

Co-operators officials were unavailable. The Saskatchewan government is mulling its own lawsuit against ISM. "We are considering all of our options," Andrew Thomson, Saskatchewan's Minister of Information Technology, said yesterday.

The suit stems from the disappearance on Jan. 16 of a computer disk from ISM's Regina office. The disk included a slew of confidential data, including account records for customers of SaskPower, SaskTel and the provincial workers' compensation plan. The disk also contained data affecting 180,000 customers of Co-operators, as well as pension plan information for Saskatchewan government employees.

On Sunday, Investors Group, the country's largest mutual fund company, disclosed the disk held account information for two-thirds of its one million clients. ISM has a contract with Investors Group to produce quarterly statements (clients of Mackenzie Financial, owned by Investors Group, are not affected).

Yesterday, Investors Group took the extraordinary step of sending a letter to its clients to ease their concerns about the information.

"The security of your information is a top priority for Investors Group, and we take this incident very seriously," Jeff Orr, the company's president and chief executive officer said in the letter.

Several Investors Group offices across Canada were flooded with calls from clients concerned about the missing data.

"I certainly know that the phone is ringing a little bit more than it normally does," said Bill Charles, an Investors Group manager in Brampton, Ont. "People are handling it pretty well."

Ron Arnst, a spokesman for Investors Group, said the company not would be using ISM again "until we have assurances the proper procedures are in place to protect the security of that data."

Co-operators has also said it is reviewing its relationship with ISM.

Dan McMurtry, ISM's CEO, indicated yesterday that no other companies are affected by the computer disk problem. He has also apologized for the problem and added the company is working closely with police.

Investors Group said it was initially told by ISM that the lost data included "a small amount of securely protected Investors Group data," Mr. Orr said in his letter.

However, on Jan. 29, ISM told Investors Group the lost information included names, addresses, account numbers and portfolio holdings for two-thirds of company clients.

Investors Group did not disclose the problem publicly until Sunday. Mr. Arnst said the company did not notify clients because it did not know the scope of the problem until last weekend.

Although ISM reported the missing hard drive as a theft, Sgt. Rick Bourassa of Regina City police said yesterday that investigators have not yet established "conclusively that it is a theft. We're not there yet."

Sgt. Bourassa said the police are considering a number of scenarios, ranging from the possibility that the hard drive was stolen only to make use of its huge storage capacity or rather by someone seeking to use the personal data for fraud-related crimes.

If the drive was stolen for so-called identity theft purposes, police experts said it would rank as the largest such crime ever in Canada. Typically, identity thieves steal such personal data as addresses and financial statements to obtain new credit cards or bank loans under false pretences. It can be weeks or months before financial institutions discover the fraud.

Police experts say that past credit fraud cases in Canada that involve stolen customer data have typically involved small numbers of victims. With thousands of customer files potentially vulnerable in the ISM case, one senior commercial crimes police expert said: "You are talking about a potential fraud crisis."

Sgt. Bourassa said the Regina police have received no complaints from individuals or companies about suspicious financial transactions relating to the missing ISM data.

Missing disk, missing data
Though it's barely the size of a video-cassette, the computer hard-disk drive that went missing on Jan. 16 from ISM Canada Inc. of Regina, a unit of IBM Canada Ltd., can store an incredible amount of information.

Here's a list of some of the data known to be on that disk:
Custodian: Investors Group Inc.
Affected: 650,000
Missing: Mutual fund statements; names, addresses, and client account numbers
-*****
Custodian: Co-operators General Insurance Co.
Affected: 180,000
Missing: Account passwords, social insurance numbers, names, addresses and other details of life
-*****
Custodian: Saskatchewan Workers' Compensation Board
Affected: Unknown
Missing: Personal information
-*****
Custodian: SaskPower
Affected: 10,000
Missing: Personal financial information
-*****
Custodian: Saskatchewan Ministry of Health
Affected: 3,000
Missing: Provincial health card numbers and related personal information
-*****
Custodian: Saskatchewan Ministry of Transportation
Affected: 3,000
Missing: Drivers' licence information
-*****
Custodian: Saskatchewan Ministry of Finance
Affected: Unknown
Missing: Saskatchewan government employee information and information on the province's bulk fuel rebate program
SOURCE: GLOBE AND MAIL STAFF
-****
-****

Corrections

Certain articles published Jan. 31, 2003, and Feb. 4, 2003, discussed certain customer data on a computer hard disk, which had been reported missing from ISM Canada last month, related to data of Co-operators Life Insurance Co. of Regina. The Globe and Mail wishes to clarify that the data that was reported missing was data only of individual life and pension clients of Co-operators Life Insurance Co., and was not data of any other insurance company within the Co-operators group, such as Co-operators General Insurance Co. We apologize for any confusion.
(Thursday, February 27, 2003, Page B2)