'Foreseeable' cyberattack on N.L. health network hit majority of province: report
The ransomware attack that hit Newfoundland and Labrador's health-care IT systems in 2021 was "almost an inevitability" and resulted in the theft of personal data from the "vast majority" of the province's population, says a report released Wednesday.
The security of the province's health information system was lacking in several important areas, and officials knew about the weaknesses but did not take appropriate action to fix them, said the 115-page report from the office of the province's information and privacy commissioner.
"We understand that sometimes mistakes happen and accidents happen … in our estimation, that is not what happened here," Sean Murray, who led the investigation, told reporters. "It was pretty clear that we did not have in this province appropriate cybersecurity measures in place in our health-care system prior to the cyberattack. And that was the major contributor to the cause of the cyberattack."
Moreover, health officials broke provincial privacy laws by not disclosing key information within a reasonable time frame about the nature of the attack and whether information had been stolen, Murray said. They also broke privacy laws by not sufficiently protecting the information in the first place, he added.
Widespread IT outages hit the province's health-care system beginning Oct. 30, 2021, forcing doctors and nurses in a major St. John's hospital to resort to pen and paper to keep track of patients. Thousands of appointments were cancelled, including cancer care, as officials scrambled to figure out what happened and get systems up and running.
The government has been tight-lipped about what happened, and it didn't reveal until March that the attack involved ransomware -- a type of malicious software used by hackers to encrypt or steal data until victims pay a ransom.
The Hive ransomware was behind the hit, Justice Minister John Hogan said at the time, adding that he could disclose the culprit because the group had been dismantled in January by the FBI and no longer posed a threat. Until then, officials had said that disclosing the nature of the attack would have compromised security.
The report said the delay in that disclosure was "concerning" and the rationale given by authorities to justify it was insufficient.
Hogan has also said that the hackers broke into the IT system of the Newfoundland and Labrador Centre for Health Information through a virtual private network that they had accessed with stolen login information. The report says an email phishing scam is most likely to blame.
The report says the hackers triggered alerts within the computer systems before they deployed their attack, which were not properly investigated. A proper investigation may have stopped the attack, or lessened its impacts, Murray wrote. His report also outlines several instances where officials had information about security vulnerabilities or were warned about the increasing risk of cyberattacks -- particularly of ransomware attacks -- against health-care systems.
Last December, provincial health officials said a review of a network drive accessed by the hackers showed that more than 58,000 people in the province had their data breached.
But Tuesday's report says the perpetrators also stole personal and health information from data repositories belonging to three of the province's four health authorities. Though the exact number of victims is unknown, the report says the information stolen includes at least nine years of data from each authority as well as information belonging to everyone in the province who had a COVID-19 test before 2021.
"The total number of privacy breaches caused by the cyberattack is unknown but it is likely to be in the hundreds of thousands," Murray wrote. "In other words, it is likely that the vast majority of the population of the province had some amount of personal information or personal health information taken by the cyberattackers."
Ultimately, the perpetrators managed to steal more than 200 gigabytes of data, the report says.
Problems aside, the report also notes that the province's response to the attack was "by and large carried out well." It also says "an impressive amount of work" has been done to implement proper cybersecurity measures to avoid a future attack.
The provincial Justice Department issued a statement Wednesday after Murray's news conference to say it was reviewing the report's 34 findings and six recommendations.
"This was a complex cybersecurity incident, but we are confident that reasonable security steps have already been taken -- and are being taken -- to mitigate the risk of a potential future incident," Hogan said in the release.
This report by The Canadian Press was first published May 24, 2023.
CTVNews.ca Top Stories
BREAKING Trudeau promises $1B in loans for child-care providers to expand care centres
The federal government is launching a new loan program to help child-care providers in Canada expand their spaces, and will be extending further student loan forgiveness and training options for early childhood educators, Prime Minister Justin Trudeau announced Thursday.
Spring allergy season has begun. Where is it worse in Canada?
The spring allergy season has started early in many parts of Canada, with high levels of pollen in some cities already. Experts weigh in on which areas have it worse so far this season.
'Nonsense:' Doug Ford slams lawsuits filed by Ontario school boards against social media platforms
Premier Doug Ford says that lawsuits launched by four Ontario school boards against a trio of social media platforms are “nonsense” and risk becoming a distraction to the work that really matters.
Several flight attendants from Pakistan have gone missing after landing in Canada
Multiple flight attendants from Pakistan International Airlines have abandoned their jobs and are believed to have sought asylum in Canada in the past year and a half, a spokesperson for the government-owned airline says.
N.B. man wins $64 million from Lotto 6/49
A New Brunswicker will go to bed Thursday night much richer than he was Wednesday after collecting on a winning lottery ticket he let sit on his bedroom dresser for nearly a year.
Multiple bridges in Calgary shut down for police incident
Calgary police have shut down a number of bridges into and out of the downtown core as officers deal with a distraught individual.
King Charles calls for acts of friendship in first public remarks since Kate's cancer diagnosis
King Charles III gave public remarks for Maundy Thursday, addressing the importance of acts of friendship, following his and Catherine, Princess of Wales’ cancer diagnoses.
Fallen crypto mogul Sam Bankman-Fried sentenced to 25 years in prison
Crypto entrepreneur Sam Bankman-Fried was sentenced Thursday to 25 years in prison for a massive fraud that unravelled with the collapse of FTX, once one of the world's most popular platforms for exchanging digital currency.
A dog and a bird formed an unlikely friendship. Their separation has infuriated followers
Peggy is a stout and muscular Staffordshire bull terrier, and Molly is a magpie, an Australian bird best known for swooping on humans during breeding season, not for befriending dogs. But in an emotional video posted online, Peggy’s owners announced that the animals had been separated.