Nova Scotia estimates up to 100,000 people affected by online security breach
As many as 100,000 Nova Scotians may have had sensitive personal information stolen in a global privacy breach affecting a file transfer system used by the provincial government, officials confirmed Tuesday.
Cybersecurity and Digital Solutions Minister Colton LeBlanc said a government investigation indicates social insurance numbers, addresses and banking information of current employees of the public service, as well as those at Nova Scotia Health and the IWK hospital, were taken.
LeBlanc says some information may also have been stolen from former public service and health authority employees. He said the information was shared through the MOVEit file transfer service, which the province uses to transfer employee payroll information.
"The investigation remains underway so there is the potential for this number to go up or to go down," the minister said. "I know this is an alarming situation, but rest assured we are working hard to solve this quickly and efficiently."
LeBlanc said the province is working to contact those affected and will be offering them a free credit monitoring service. "But when we are talking 100,000 Nova Scotians, that's going to be a challenge," added LeBlanc, who pointed out some people's contact information may have changed over the years. He also urged current and former employees to look for suspicious transactions and to contact their banks.
The department's deputy minister, Natasha Clarke, said that at this point there is no indication that any of the information compromised came from members of the public who were not provincial employees.
MOVEit software is made by Massachusetts-based company Ipswitch and allows organizations to transfer files and data between employees, departments and customers. Parent company Progress Software confirmed a vulnerability in its software last week, saying the issue could lead to potential unauthorized access of users' systems and files.
The Nova Scotia government has said it was first informed of a critical vulnerability within its system on Thursday. The province took the service off-line and installed a security update before bringing it back online Friday, only to be told further investigation was needed. Cybersecurity experts were then called in on Saturday evening.
Clarke confirmed the investigation indicates that the data was stolen two days before the Nova Scotia government learned of the vulnerability. "So once we put the patching in place, there was no more nefarious activity that we were able to see," she said.
Microsoft Threat Intelligence has said in a tweet that the Lace Tempest hacking group, which is known for running the Clop extortion site, exploited that vulnerability.
LeBlanc would not confirm who had hacked into Nova Scotia's system, adding "I am not going to comment on interactions with criminals." But Clarke said the government "at this point in time" is not negotiating with the hackers.
"Now the focus is understanding the impact of the data that has been stolen, and we have not been asked for any ransom," she said.
The deputy minister said the government has been working with its internal security team as well as with outside experts, including an unnamed large private firm that the province has on retainer. Clarke said Nova Scotia is also working with the Canadian Centre for Cyber Security.
In an email, MOVEit said it disabled web access to protect customers and developed the security patch and gave it to customers within 48 hours of discovering the vulnerability.
"We are continuing to work with industry-leading cybersecurity experts to investigate the issue and ensure we take all appropriate response measures," the company said. "We have engaged with federal law enforcement and other agencies with respect to the vulnerability."
This report by The Canadian Press was first published June 6, 2023.
For more Nova Scotia news, visit our dedicated provincial page.
CTVNews.ca Top Stories
![](https://www.ctvnews.ca/polopoly_fs/1.6955721.1720468041!/httpImage/image.jpg_gen/derivatives/landscape_800/image.jpg)
Ex-Quebec junior hockey players jailed for sexual assault of teen at hotel in 2021
Two former Quebec junior hockey players were handed prison sentences Monday for sexually assaulting a minor at a hotel in June 2021 in the aftermath of a Victoriaville Tigres championship celebration.
Bodies of 3 mountaineers recovered near Squamish, B.C.
The bodies of three mountaineers who died on a difficult climb near Squamish, B.C., earlier this year have been recovered, authorities said Monday.
'Nobody said anything': Former student recalls sexual advances by Frank Stronach
A former student and scholarship recipient at the company once helmed by Frank Stronach is speaking out about an “unwelcome but not illegal” sexual interaction involving the billionaire in the 1980s, when he was in his 50s and she was 19 years old.
B.C. buyers who backed out of home purchase ordered to pay more than $350K in damages
Would-be homebuyers who backed out of a deal to purchase a B.C. property in a hot real estate market have been ordered to pay the seller the difference between what they offered and what he was able to sell the home for when the market cooled.
Ticketmaster reports 'data security incident,' customers' personal information may have been stolen
Ticketmaster says it was the victim of a 'data security incident' and the information customers provide to the company may have been compromised.
Parkinson's specialist met with Biden's physician at the White House earlier this year, records show
A top Parkinson’s disease specialist held a meeting with U.S. President Joe Biden’s physician at the White House earlier this year, according to records.
Justin Bieber performs at pre-mega wedding celebration in India
Concerts, catwalks and cruises are how a rich couple in India are celebrating their wedding-to-be.
Alice Munro's daughter sees outpouring of messages after essay on mother's silence to her sexual abuse
Social media saw a flood of messages for Andrea Robin Skinner, daughter of late Canadian author Alice Munro, after an eye-opening personal essay about her sexual abuse by her stepfather published this weekend.
Actor known for roles on 'Bob's Burgers' and 'Arrested Development' pleads guilty over role in Capitol Attack
Jay Johnston, known for his roles on 'Bob's Burgers' and 'Arrested Development,' pleaded guilty Monday over his involvement in the Jan. 6 Capitol Attack.