Data theft and weapons importation charges have been filed against a former employee of a Canadian public-sector organization. According to Transport Routier, in an article dated November 12, 2026, the charges were laid by the Unité permanente anticorruption.
Key points
- Data theft charges have been filed against a former employee of a Canadian auto insurance Crown corporation.
- Insider risk exists in every organization: a departing employee’s access must be revoked without delay.
- An SMB can check this week who still holds access to its data, with no special tools required.
What we know about the incident
The case is based in Canada and involves a public-sector organization, an auto insurance Crown corporation. The source does not specify the city, the timeframe of the alleged acts, or the exact nature of the information involved. At this stage, these are charges, not a conviction.
Transport Routier reports, on November 12, 2026, that the charges cover both data theft and weapons importation. The source does not say how the data was allegedly obtained, nor how many people may be affected. We are sticking to what is publicly established.
What matters for a business owner here is not the legal detail but the type of scenario. Someone who had legitimate access to personal information as part of their job remains, long after leaving, a possible entry point to that information.
An employee’s departure is a moment for vigilance
In a small team, access accumulates over the years: email, shared folders, payroll software, banking portal, phone provider account. When an employee leaves, the computer and the office key get collected, but accounts are often forgotten. They stay open.
The general mechanism is mundane. No one kept a list of granted access, so no one can cleanly undo it. On top of that, shared accounts whose password is known to only a few people are rarely changed after someone leaves. An SMB with a handful of employees is just as exposed as a large organization: the volume of data differs, not the underlying logic.
The Canadian Centre for Cyber Security lists account and privilege management among its baseline controls for small and medium organizations. It is first and foremost a matter of discipline, even though reviewing and revoking access can take time or resources depending on the environment. And it should be said plainly: no provider can guarantee zero risk on the human factor.
Checks to run this week
This means rebuilding the list of your organization’s access accounts, comparing it against your current employees, and then examining every account that matches no one currently on staff: some service or vendor accounts remain legitimate. Depending on your environment, this review may require time from your IT provider or additional resources.
Ask your IT provider for the complete list of active accounts, specifying who each one belongs to. Have management validate this list, since only they know who still works for you. For each account with no identified owner, check who owns it, what it is used for, and whether it is still needed before disabling it: a service account or vendor access can be essential to day-to-day operations. Have your accounting team check access to banking services and payroll software, which are often overlooked because they don’t run through IT. Finally, add access revocation to your offboarding procedure, on the same footing as collecting keys.
Theft of personal information is not measured in IT costs. It is measured in customers who must be notified, trust that has been damaged, and management time spent handling a crisis instead of running the business.
FAQ
Can a former employee still access my company’s data?
Yes, if their accounts have not been disabled. Some organizations have an automated process that cuts off access at departure, but it does not always cover every service: work email, online shared folders, remote access, tools a team subscribed to directly. We recommend checking, service by service, that access has in fact been removed, rather than assuming it. Also plan to change shared secrets, passwords for shared accounts, and access codes, at the time of departure.
What does Law 25 require if personal information leaves my company?
Quebec’s private sector law on the protection of personal information requires businesses to keep a register of confidentiality incidents. When an incident presents a risk of serious harm, the Commission d’accès à l’information (Quebec’s privacy regulator) and the affected individuals must be notified. This obligation applies regardless of company size, including to a business with only a few employees.
How can a small team reduce insider risk?
By giving everyone only the access their role actually requires, and nothing more. Avoid shared accounts where possible, since they make it impossible to know who did what. Document who has access to what on a simple, regularly updated sheet. These steps do not eliminate the risk, but they make this kind of scenario considerably harder to pull off.
Sources
- Transport Routier, via Google Actualités · press, November 12, 2026
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · reference control list
- Commission d’accès à l’information du Québec · obligations, incident register and notification
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial charter.
