N.S. government to contact people impacted by cybersecurity breach

Nova Scotia’s government and cybersecurity experts are working to get to the bottom of a breach that still isn't fully understood.

"This is potentially quite damaging in terms of the sensitivity of the information that could be moved around,” said David Shipley, a cybersecurity expert based in Fredericton and founder of Beauceron Security.

Shipley said the third-party software service that the breach occurred through, called MoveIt, has been a hot target for cybercriminals, and this is the third major wave of attack it has suffered since December 2020.

"This morning, Microsoft came out and has attributed this attack to a group that it calls Lace Tempest,” Shipley said. “It's also known as the Clop Ransomware gang or fin11. This is an active group, they know what they're doing."

Shipley said now the question is what kinds of personal information might they have accessed.

"Was there detailed medical information about me that was lost?” he said. “Diagnoses, prognoses, diagnostic imaging. Those are going to be important questions to ask."

"I certainly do not want to speculate at this time as our investigation is still ongoing,” said Nova Scotia Cybersecurity Minister Colton Leblanc.

Leblanc said government also still doesn't know how many Nova Scotians have been impacted, but said those affected will be contacted.

In the meantime, they've set up a privacy breach alerts and information webpage to help people beware of any further scammers.

"We do not want Nova Scotians to believe that when government contacts them, that we'll be soliciting them for any personal information,” Leblanc said. “So all of those types of details are clearly outlined online."

It's not the first time something like this has happened.

For instance, in August 2020, Nova Scotia’s Department of Health contacted 211 people whose personal information was inappropriately accessed.

"I do think they are following best practices and being transparent, and I think we need to give them time now to make sure the incident is contained, understand the scope of it and communicate with those who are unfortunately impacted,” Shipley said.

For now, MoveIt has been taken offline on all government services.

For the latest Nova Scotia news, visit our dedicated provincial page.