OTTAWA — The credit agency hired by Mackenzie Investments to guard customers’ identities after a supply chain hack exposed their personal information is buckling under the demand.

“We are experiencing higher than usual volumes and are doing everything we can to try to assist as many people as possible,” TransUnion told Mary Kate Williamson after she complained on Twitter, one of many responses to exasperated people trying to sign up for its services.

The data compromise began with a cyberattack on a vendor to a vendor to Mackenzie. It’s affecting customers of customers of Mackenzie’s. Williamson told The Logic she had never even heard of Mackenzie until a couple of days ago.

“I must have a mutual fund that’s administered by them somehow,” she said. “But I received the letter from them saying that my name, address and social insurance number had been exposed in a data breach, and that they were very sorry and that they were going to give me two years of credit monitoring service.”

When she tried to sign up for TransUnion’s monitoring at mytrueidentity.ca, however, the site told her its authentication service was down and offered a phone number.

“I called the number and it said the number’s not in service. Called again—number’s not in service. So then I Googled the TransUnion phone number, and called TransUnion, and they were very apologetic. They said they’re dealing with this massive data breach and their systems just can’t keep up,” Williamson said.

It took a day and a half of failed calls, hours-long waits on hold (“that hold music is ingrained my brain”) before being disconnected, calls to Mackenzie where the phone rang without being answered, a call to Mackenzie that was finally answered by a system that forwarded her back to TransUnion, and a period when she was on hold with TransUnion using two different phones before she reached a person who could sort her out.

“Why am I spending hours of my time on hold when you guys are the ones who made the mistake?” Williamson asked rhetorically. “You guys are the ones who are completely failing at trying to resolve the situation at all and just saying, ‘Well, it’s high call volumes.’ Well, yeah, high call volumes because you let a bunch of people’s data go to, I don’t know, hackers or the dark web.”

Nini Krishnappa, the vice-president of corporate communications at Mackenzie’s parent company IGM Financial, has previously told The Logic that Mackenzie has no positive evidence that any customer data is in the wrong hands—just that it’s a possibility.

The financial-services company is one of many affected by a cyberattack in January on a file-transfer service called GoAnywhere offered by Minneapolis-based Fortra. Mackenzie doesn’t use GoAnywhere directly; a vendor, Toronto’s InvestorCOM, which acts as an intermediary for Mackenzie’s contacts with investment customers, uses it.

The Logic asked Krishnappa by email how Mackenzie chose TransUnion for the current work, whether it’s considered changing vendors, and whether publicly appreciating customers’ patience is enough.

He sent a statement from Mackenzie: “Call volumes have been particularly high and we sincerely apologize to those who are experiencing long wait times when trying to register for credit monitoring services. We’re advising impacted investors who have received a letter and have an activation code to enroll online at www.mytrueidentity.ca. Impacted investors have until Aug. 31, 2023 to enroll.”

Another customer in Ottawa, Gen Lamorie, said she hasn’t had investments with Mackenzie in three years but got a heads-up from her financial advisor and a letter saying her personal data was involved in the incident. Her experience has been similar to Williamson’s, with multiple failed calls, website errors and a Twitter exchange.

“Mackenzie was actually infuriating. It’s canned answers, I would think, but obviously not reading the details of what the issue is,” Lamorie said.

She said her advisor told her that TransUnion is dealing with 1.5 million Mackenzie investors who’ve received alert letters and has increased its staff dealing with them, from fewer than 10 people to 17.

“We are aware of extended wait times in our call center, and we apologize for any inconvenience,” TransUnion’s director of corporate affairs and communications Hyunjoo Kim wrote in an email to The Logic. “We are continuing to enhance our service capacity, and we encourage consumers to take advantage of the online enrollment process to avoid wait times.”

Lamorie said she’s considering paying for credit monitoring from TransUnion competitor Equifax. Williamson said that given the information she’s been told is at risk—her name, address and social insurance number, which she’s not about to change—two years of protection probably won’t be enough for someone who habitually gets free credit reports on herself as often as she can, just to keep tabs.

“I’m probably going to end up having to pay for it forever now,” Williamson said.

Editor’s note: This story has been updated to add a statement from TransUnion, received after publication.