N.S. teachers, students, health-care workers impacted by cyber attack

Nova Scotia says it has identified more details about the records stolen in a file transfer service cyber attack, impacting teachers, students and health care workers' records.

As many as 100,000 Nova Scotians' are estimated to have had personal information stolen due to a privacy breach affecting the file transfer software MOVEit, the province said Tuesday.

The province said in a statement Friday that the breach includes about 55,000 records of past and present teachers in the province, records of 26,000 students over the age of 16 and records of 5,000 short-term housing accommodations owners that are registered with the Tourist Accommodations Registry.

Also impacted by the cyber attack are 3,800 people who applied for jobs with Nova Scotia Health, about 1,400 Nova Scotia pension recipients and 1,085 people who have been issued parking tickets in Halifax.

"I know that providing more detailed information will cause more concern and questions. No individual or organization is immune from cyber threats or theft," Cyber Security and Digital Solutions Minister Colton LeBlanc said Friday.

"I strongly encourage Nova Scotians to reach out to their financial institution to flag the risk. We will continue to provide updates on what we are learning through our investigation."

Minister of Services Nova Scotia Colton LeBlanc speaks during a news conference at Province House in Halifax on Wednesday March 22, 2023. (THE CANADIAN PRESS/Lyndsay Armstrong)It will be hard to understand the number of individual Nova Scotians who are impacted by the cyber attack, because multiple accessed records could belong to the same person, the province said.

“For example, someone who is a certified teacher could be working as a civil service employee and have received a parking ticket,” said the statement.

“The government's priority is to assess the extent of the breach and notify those impacted.”

According to a letter sent to students and parents from the Halifax Regional Centre for Education Friday afternoon, personal information of students aged 16-18 as of Jan. 31, 2023 may have been taken in the breach. This information was in the province’s database because it was shared with Elections Nova Scotia for voting pre-registration.

Students’ full names, gender, date of birth, school they attended, student ID, civic address and mailing address may have been accessed. This breach does not include social insurance numbers or banking information.

BREACH DETAILS

• about 55,000 records of past and present certified and permitted teachers in Nova Scotia, including name, address, date of birth, years of service and educational background. The information does not include social insurance numbers or banking information. The list includes people born in 1935 or later.
• about 26,000 students, aged 16 years and older, including date of birth, gender, student ID and school. This information was in the database because it was shared with Elections Nova Scotia.
• about 5,000 short-term accommodations owners in the Tourist Accommodations Registry. The information stolen included name, owner's address, property address and registration number.
• about 3,800 people who applied for jobs with Nova Scotia Health, including their demographic data and employment details. Social insurance numbers were not included.
• about 1,400 Nova Scotia pension plan recipients. Their names, social insurance numbers, dates of birth and demographic data were stolen.
• 1,085 people issued Halifax Regional Municipality parking tickets. Names, addresses and licence plate numbers were stolen.
• about 500 people in provincial adult correctional facilities; name, date of birth, gender, prisoner ID number and status in the justice system were stolen.
• about 100 Nova Scotia Health vendors, including product and pricing information. Vendors' banking information does not appear to be included.
• 54 people issued summary offence tickets; names, driver's licence numbers and dates of birth were stolen.
• 54 clients of the Department of Community Services, including names, addresses, client ID and transit pass photos.
• about 1,330 people in the Department of Health and Wellness client registry, including name, address, date of birth, and health card number.
• at least 150 people in the Department of Health and Wellness provider registry, including doctors, specialists, nurses and optometrists. Assessments are ongoing. The information taken includes names, addresses and dates of birth. It does not include social insurance number or banking information.
• about 60 people with the Prescription Monitoring Program, including names, addresses, dates of birth, health card numbers and personal health information.
• 41 newborns born between May 19 and 26. Information stolen includes last name, health card number, date of birth and date of discharge. Parents will be notified.

For more Nova Scotia news visit our dedicated provincial page.