'Foreseeable' cyberattack on N.L. health network hit majority of province: report
The ransomware attack that hit Newfoundland and Labrador's health-care IT systems in 2021 was "almost an inevitability" and resulted in the theft of personal data from the "vast majority" of the province's population, says a report released Wednesday.
The security of the province's health information system was lacking in several important areas, and officials knew about the weaknesses but did not take appropriate action to fix them, said the 115-page report from the office of the province's information and privacy commissioner.
"We understand that sometimes mistakes happen and accidents happen … in our estimation, that is not what happened here," Sean Murray, who led the investigation, told reporters. "It was pretty clear that we did not have in this province appropriate cybersecurity measures in place in our health-care system prior to the cyberattack. And that was the major contributor to the cause of the cyberattack."
Moreover, health officials broke provincial privacy laws by not disclosing key information within a reasonable time frame about the nature of the attack and whether information had been stolen, Murray said. They also broke privacy laws by not sufficiently protecting the information in the first place, he added.
Widespread IT outages hit the province's health-care system beginning Oct. 30, 2021, forcing doctors and nurses in a major St. John's hospital to resort to pen and paper to keep track of patients. Thousands of appointments were cancelled, including cancer care, as officials scrambled to figure out what happened and get systems up and running.
The government has been tight-lipped about what happened, and it didn't reveal until March that the attack involved ransomware -- a type of malicious software used by hackers to encrypt or steal data until victims pay a ransom.
The Hive ransomware was behind the hit, Justice Minister John Hogan said at the time, adding that he could disclose the culprit because the group had been dismantled in January by the FBI and no longer posed a threat. Until then, officials had said that disclosing the nature of the attack would have compromised security.
The report said the delay in that disclosure was "concerning" and the rationale given by authorities to justify it was insufficient.
Hogan has also said that the hackers broke into the IT system of the Newfoundland and Labrador Centre for Health Information through a virtual private network that they had accessed with stolen login information. The report says an email phishing scam is most likely to blame.
The report says the hackers triggered alerts within the computer systems before they deployed their attack, which were not properly investigated. A proper investigation may have stopped the attack, or lessened its impacts, Murray wrote. His report also outlines several instances where officials had information about security vulnerabilities or were warned about the increasing risk of cyberattacks -- particularly of ransomware attacks -- against health-care systems.
Last December, provincial health officials said a review of a network drive accessed by the hackers showed that more than 58,000 people in the province had their data breached.
But Tuesday's report says the perpetrators also stole personal and health information from data repositories belonging to three of the province's four health authorities. Though the exact number of victims is unknown, the report says the information stolen includes at least nine years of data from each authority as well as information belonging to everyone in the province who had a COVID-19 test before 2021.
"The total number of privacy breaches caused by the cyberattack is unknown but it is likely to be in the hundreds of thousands," Murray wrote. "In other words, it is likely that the vast majority of the population of the province had some amount of personal information or personal health information taken by the cyberattackers."
Ultimately, the perpetrators managed to steal more than 200 gigabytes of data, the report says.
Problems aside, the report also notes that the province's response to the attack was "by and large carried out well." It also says "an impressive amount of work" has been done to implement proper cybersecurity measures to avoid a future attack.
The provincial Justice Department issued a statement Wednesday after Murray's news conference to say it was reviewing the report's 34 findings and six recommendations.
"This was a complex cybersecurity incident, but we are confident that reasonable security steps have already been taken -- and are being taken -- to mitigate the risk of a potential future incident," Hogan said in the release.
This report by The Canadian Press was first published May 24, 2023.
CTVNews.ca Top Stories
War monitor says Assad has fled Syria after rebels enter capital
The head of a Syrian opposition war monitor said early Sunday that Syria’s President Bashar Assad left the country for an undisclosed location.
Canada Post strike: Union 'extremely disappointed' in latest offer, negotiator says
A negotiator for the Canadian Union of Postal Workers (CUPW) says the latest offer from Canada Post to end the ongoing strike shows the carrier is moving in the "opposite direction."
Search for UnitedHealthcare CEO's killer yields evidence, but few answers
As the search for UnitedHealthcare CEO Brian Thompson’s killer goes on, investigators are reckoning with a tantalizing dichotomy: They have troves of evidence, but the shooter remains an enigma.
Digging themselves out: With Santa Claus parade cancelled, Londoners make best of snowy situation
Londoners continue to dig themselves out from this week’s massive snowstorm.
Trump is welcomed by Macron to Paris with presidential pomp and joined by Zelenskyy for their talks
French President Emmanuel Macron welcomed Donald Trump to Paris with a full dose of presidential pomp for the reopening of the Notre Dame Cathedral.
Groups launch legal challenge against Alberta's new gender-affirming treatment law
A pair of LGBTQ2S+ advocate organizations say they've followed through with their plan to challenge Alberta's three transgender bills in court, starting with one that bars doctors from providing gender-affirming treatment such as puberty blockers and hormone therapy for those under 16.
Canada's air force took video of object shot down over Yukon, updated image released
The Canadian military has released more details and an updated image of the unidentified object shot down over Canada's Yukon territory in February 2023.
U.S. announces nearly US$1 billion more in longer-term weapons support for Ukraine
The United States will provide nearly US$1 billion more in longer-term weapons support to Ukraine, Defense Secretary Lloyd Austin said Saturday.
New plan made to refloat cargo ship stuck in St. Lawrence River for two weeks
Officials say they have come up with a new plan to refloat a large cargo ship that ran aground in the St. Lawrence River two weeks ago after previous efforts to move the vessel were unsuccessful.