Mounties investigating claims servers with personal info for sale online

Servers for sale: Is your private info at risk? A defunct computer retailer is at the centre of an RCMP investigation over concerns private information could get into the wrong hands.

A defunct Metro Vancouver computer retailer is at the centre of an RCMP investigation due to concerns the private information of former customers could get into the wrong hands.

Richmond-based NCIX had five locations in the region before declaring bankruptcy last December.

A Craigslist ad listed NCIX servers for sale, and the poster claimed they'd been bought at an auction.

"I wondered what data was on that, if it was purchased at Able (Auctions), I wonder if they wiped it," Travis Doering told CTV News.

So Doering, with the cybersecurity firm Privacy Fly, posed as a buyer.

"When I arrived, I discovered that what was listed in the Craigslist ad as being from Able Auctions was simply a mask to cover the fact he was hawking their entire East Coast server farm," Doering said.

"Which contained essentially every customer record: Names, email addresses, phone numbers, serial numbers of device purchases, credit card information in plain text."

Doering said the seller told him NCIX's landlord had kept the unencrypted servers and data and was selling them to recoup money the bankrupt company still owed.

"He later made me an offer of $15,000 to rent the room and copy all of the data from the devices," he said.

Employee information was offered for sale too.

"I'm really shocked and disappointed," said Kevin Ma, who worked at NCIX for 16 years.

"Even SIN card information, all our T4s, all our financial information happening at NCIX in the past 10 years is all there."

CTV reached out to NCIX owner Steve Wu, but he didn't respond. Doering said he'd heard from employees that Wu went to China.

Richmond RCMP posted on social media they'd opened an investigation Thursday into the case.

"We have since recovered the storage devices. Our investigation is active and on-going," the tweet said.

But it may be too late for those whose data was stored in the servers.

"The police may have seized the servers but the data was copied long ago… The data is in the hands of third parties," Doering said.

With a report from CTV Vancouver's Shannon Paterson