The City of Waterloo and Wilmot Township have told families that the full names of children and details about the activities they had registered for were temporarily visible to other users on a third‑party booking platform used for drop‑in sports.
What was exposed
In notices sent to parents, Waterloo officials said that first and last names of children appeared on PickupHub, along with the program name, venue, date and time of the game the child had been signed up for. Wilmot Township confirmed it learned of the issue last week and is notifying affected families directly.
- Platform affected: PickupHub, a third‑party online reservation system.
- Scope: Information related to past youth drop‑in games.
- Timing: Incident discovered and reported to municipalities last week.
City staff told families the incident involved only past games, noting Waterloo currently does not list any future youth games on PickupHub’s YouthHub sub‑portal. The city also pointed out that youth games are posted only in the summer.
Municipal response and next steps
In its notice, Waterloo said staff are working with PickupHub to determine how the exposure happened and what measures will prevent a recurrence. Wilmot’s statement said the township is working to "improve account" controls and is in the process of notifying parents of affected users.
"City staff continue to work with PickupHub to learn the cause of the incident and how it will be prevented from happening again," the City of Waterloo said in its notice.
Officials did not release a figure for how many children were affected or specify the exact window during which the information was accessible. Municipal records show YouthHub is a dedicated section on PickupHub that parents use to sign their children up for drop‑in sports; Waterloo only posts youth games seasonally.
Local context and concerns
For parents and guardians in Waterloo, the revelation raises questions about how third‑party vendors manage account privacy and what safeguards municipal partners require. The disclosure of names linked to program times and locations can be particularly sensitive when it involves children, generating concerns about safety and unwanted contact.
Municipal recreation services increasingly rely on external booking platforms to manage registrations, payments and facility access. That dependence can speed up access and streamline operations, but it also places pressure on cities and townships to vet vendors’ data protection practices and to have clear protocols for responding to incidents.
| Detail | Reported |
|---|---|
| Platform | PickupHub |
| Type of information | Children’s full names; program, venue, date and time |
| Affected offerings | Past youth drop‑in games (YouthHub) |
Municipal staff said they will continue to liaise with PickupHub to identify the technical cause and to implement fixes. Parents have been advised to watch for direct communications from the city and from Wilmot Township if their child’s information was affected.
As investigations proceed, the incident highlights the balance municipalities must strike between offering modern online services and safeguarding personal information — especially when that information concerns minors. Families seeking more information should consult the notices issued by the City of Waterloo and the Wilmot Township office.
