Some patient, employee information accessed in N.L. cyberattack, government says
The Newfoundland and Labrador government revealed Tuesday that whoever was behind a cyberattack that has hobbled its health-care system managed to obtain personal information of patients and employees.
Government officials told a briefing that some patient and employee information from two health authorities was accessed through an online data repository. They don't know how many people were affected.
"Through the course of the investigation thus far, it has been determined that some personal information and personal health information has been accessed," Premier Andrew Furey told a news conference in St. John's. "I know that that sounds alarming and frightening. We do know that there is no indication that the personal information or personal health information has been misused."
He said there was no evidence banking information had been accessed. "The appropriate authorities have been contacted and are on the case," Furey said.
Officials at the briefing said the employee information accessed included names, addresses, contact information, employee identification numbers and social insurance numbers. Patient information included health card numbers and providers, reasons for visiting health-care facilities, phone numbers, marital status and maiden names.
The information accessed from the eastern health authority goes back about 14 years, they said, and the data accessed from the Labrador-Grenfell Health authority goes back about nine years.
"I think this is quite a serious breach," said David Diamond, chief executive officer of the eastern health authority. "We're in no way suggesting that this information is not quite significant and serious."
Security experts have questioned why the Newfoundland and Labrador government has released few specifics about the cyberattack since it was detected Oct. 30.
Officials have so far refused to say what kind of an attack the province is facing and whether the hackers involved have asked for money. Outside experts say it has all the signs of a ransomware attack, in which hackers infiltrate an information technology network and demand payment in return for restoring access.
Brian Honan, the head of Ireland's Computer Security Incident Response Team, said government representatives in that country were on national radio the morning after a similar attack was discovered last May, "telling people what happened, how it happened, what the impact would be."
"They came up very early and said they would not be negotiating with criminals, they would not be paying the ransom demand and they will be looking to restore systems as quickly as possible," Honan said in a recent interview.
People were worried about their private information being published by the hackers, and the government's transparency helped them understand what to expect, he said.
The attack in Newfoundland and Labrador affected what Health Minister John Haggie described as the "two brains" behind the provincial health network's data centre. Without access to such things as basic email, diagnostic images and lab results, the eastern health authority -- which includes several major hospitals in St. John's -- was left operating largely with pen and paper and running only emergency services.
Thousands of medical appointments have been cancelled, though the health authority has been able to resume some cancer care, such as chemotherapy and radiation.
Brett Callow, a British Columbia-based threat analyst for Emsisoft, an international cybersecurity firm, said there could be "very good reason" for the Newfoundland and Labrador to keep quiet, even 11 days after the attack was first discovered.
"For example, they may not be sure that the attackers are not still in the network," Callow said in an interview Monday. "And they don't want to say anything that could antagonize them or give them a heads-up as to what mitigations may be in progress."
Ontario-based health-care cybersecurity expert Anne Genge agrees it is curious to have so little information at this point, but said there are many factors for governments to consider in attacks like the one facing Newfoundland and Labrador. If the hackers have threatened to publish health-care information, that makes the considerations all the more complicated, she said.
"Health information is really the most sensitive and potentially embarrassing information about an individual," Genge said in an interview Tuesday. "Because you have treatments, diagnoses, your medications, mental health status, your sexual preference." That information can be used to discriminate again people, or event extort them, she said.
This report by The Canadian Press was first published Nov. 9, 2021.
CTVNews.ca Top Stories
More than 115 cases of eye damage reported in Ontario after solar eclipse
More than 115 people who viewed the solar eclipse in Ontario earlier this month experienced eye damage after the event, according to eye doctors in the province.
Last letters of pioneering climber who died on Everest reveal dark side of mountaineering
George Mallory is renowned for being one of the first British mountaineers to attempt to scale the dizzying heights of Mount Everest during the 1920s. Nearly a century later, newly digitized letters shed light on Mallory’s hopes and fears about ascending Everest.
Toxic testing standoff: Family leaves house over air quality
A Sherwood Park family says their new house is uninhabitable. The McNaughton's say they were forced to leave the house after living there for only a week because contaminants inside made it difficult to breathe.
Decoy bear used to catch man who illegally killed a grizzly, B.C. conservation officers say
A man has been handed a lengthy hunting ban and fined thousands of dollars for illegally killing a grizzly bear, B.C. conservation officers say.
Sophie Gregoire Trudeau on navigating post-political life, co-parenting and freedom
Sophie Gregoire Trudeau says there is 'still so much love' between her and Prime Minister Justin Trudeau, as they navigate their post-separation relationship co-parenting their three children.
An emergency slide falls off a Delta Air Lines plane, forcing pilots to return to JFK in New York
An emergency slide fell off a Delta Air Lines jetliner shortly after takeoff Friday from New York, and pilots who felt a vibration in the plane circled back to land safely at JFK Airport.
B.C. seeks ban on public drug use, dialing back decriminalization
The B.C. NDP has asked the federal government to recriminalize public drug use, marking a major shift in the province's approach to addressing the deadly overdose crisis.
'I was scared': Ontario man's car repossessed after missing two repair loan payments
An Ontario man who took out a loan to pay for auto repairs said his car was repossessed after he missed two payments.
First court appearance for boy and girl charged in death of Halifax 16-year-old
A girl and a boy, both 14 years old, made their first appearance today in a Halifax courtroom, where they each face a second-degree murder charge in the stabbing death of a 16-year-old high school student.