When a cyberbreach evolves into a physical crime

A shared workplace password combined with an internal security shortcut resulted in $22 million in missing gold. Air Canada’s 2023 cyber incident is a jarring reminder that cybersecurity consequences don't always stay in the digital realm.

When most people picture a cyberattack, they envision stolen personal or financial data, or a ransomware infected computer system, but how often does the brain picture compromised credentials leading to physical crime?

In the Air Canada gold heist case, court testimony described security weaknesses at the airline's Toronto cargo facility, including a practice of shared employee credentials and logins (hint, don’t do this!). The resulting crime involved the theft of approximately $22 million in gold and other valuables.

The takeaway? A cybersecurity failure doesn't always end with a compromised computer. It can lead to significant financial losses, stolen inventory, operational disruption and real-world physical damage. Losses aside, it also drives home that good security is more than a policy or procedure, it’s an integral part of a healthy security culture.

Most organizations have password policies, such as: Don't share credentials, use strong passwords, lock your computer at night, follow access controls and so on. These, policies only go so far if the employees only see cybersecurity as an inconvenience, rather than a shared responsibility.  If sharing a login is seen as normal or acceptable because it's faster, or if the responsibility for protecting sensitive information is seen as stopping at IT, the policy isn't the problem. The culture is.

Strong cybersecurity starts with individual behaviours, like creating strong, unique passwords, using secure password managers, protecting access credentials and taking personal responsibility for the information entrusted to you seriously. It also requires something that is harder to mandate: pride in protecting your organization's information.

When employees understand that safeguarding data protects customers, colleagues, operations, their job security and the business itself, security becomes more than just a compliance box to check. It starts to become engrained in how the organization works.

You don't need to be an airline or handle millions of dollars in cargo to face these risks. A compromised account could expose customer information, redirect payments, facilitate theft or disrupt critical operations.

Technology and policies matter, but so do the everyday decisions employees make when nobody is watching, and the culture those employees are committed to. You can't always prevent an attack, but you can build a culture and implement the controls that make it harder for one compromised credential to become a major incident.