The office of Canada’s privacy commissioner says Shopify Inc. has yet to notify it of a recent data breach the company says was carried out by two “rogue” employees.
“We have not received a breach report about this incident,” Vito Pilieci, a senior communications adviser for the Office of the Privacy Commissioner of Canada, told The Canadian Press in an email Wednesday.
“Our office is reaching out to Shopify, given the potential seriousness of the breach, to request more information about the matter.”
Story continues below advertisement
Under the Personal Information Protection and Electronic Documents Act, it is mandatory for companies to report breaches to the privacy commissioner’s office, "where it is reasonable to believe that the breach creates a real risk of significant harm to an individual, Pilieci said.
Shopify didn’t immediately respond to a request for comment about notifying the privacy commissioner’s office. Company spokeswoman Rebecca Feigelsohn said the two employees involved …