A medicare mailing error in New Brunswick sent some residents’ personal information, including social insurance numbers (SINs), to the wrong addresses, triggering a privacy review and raising concerns about identity theft and data‑handling controls in the province’s health system.
The Department of Health confirmed that at least seven people had SINs exposed because older medicare numbers were based on social insurance numbers. Names, dates of birth and addresses were also mailed to the wrong households. About 365 households may have been affected, although officials said they did not yet know how many individuals’ data were misdirected.
How the breach was discovered
According to a report from CBC News, the issue was first flagged last Thursday when a resident contacted Service New Brunswick teleservices to report receiving someone else’s information. After a second report, medicare officials escalated the matter for investigation. The Department of Health issues medicare cards but uses Service New Brunswick to process and mail them.
In a late‑Friday news release, the government said information “may have recently been sent to the wrong addresses, potentially affecting about 365 households,” and that some people may have received other individuals’ medicare details along with their own.
Beechwood resident Shelley Tofflemire said she received a letter stating that her new medicare card would be sent shortly, which included her household’s names, addresses, dates of birth, medicare numbers, and effective and expiry dates. Behind it, she said, was another page with a different person’s information. She described the incident as a “huge data breach” and said it contained enough data to enable identity theft.
Government response and communication misstep
Local Government Minister Aaron Kennedy, who is responsible for Service New Brunswick, said in the release that “as soon as we became aware of the issue, we rectified it and have begun work on mitigating the error for those impacted,” without detailing the remediation steps. The province has notified New Brunswick’s ombud and said medicare would contact those affected with further instructions, the report said.
However, some residents who called to report receiving other people’s data said they were told simply to discard the extra pages and were not asked whose information they had. Health department spokesperson Meghan Cumby said that advice came from a Service New Brunswick agent and was not consistent with standard practice, which would be to instruct callers to return the correspondence to medicare.
Bill Hogan, health critic for the Official Opposition and MLA for Woodstock‑Hartland, called the incident “disappointing” and said it should not be taken lightly, stressing that “due diligence is extremely important” when handling private information.
Ombud Marie‑France Pelletier said the Department of Health, as a “health care custodian,” is required under the Personal Health Information and Protection of Privacy Act to notify her office and affected individuals when a breach occurs. Her office reviews such notifications to determine whether personal health information was lost, improperly disposed of or accessed without authorization, and expects custodians to contain the breach, assess risk, notify those impacted and work to prevent future incidents, according to the report.
For insurers and risk managers, the case underlines how paper‑based errors can create cyber and privacy‑type exposures. The combination of SINs, dates of birth and addresses heightens identity theft risk, while the split responsibilities between Health and Service New Brunswick highlight operational and vendor‑management vulnerabilities that are increasingly scrutinized in public‑sector cyber and privacy underwriting.
