The Independent is 100% funded by its readers. Your pay-what-you-can subscription or one-time donation provides a base of revenue to keep our bills paid and our contributors writing. For as little as $5 a month, you can fund the future of journalism in Newfoundland and Labrador.
Newfoundland and Labrador is in trouble with a recent cyberattack that has impacted much of the province’s healthcare infrastructure—with Eastern Health operating on a paper-based system into Monday, slowly bringing some services back
“We are victims of a cyberattack,” announced Health Minister John Haggie last week. A digital hijack has compromised the health records of virtually everyone living in the province.
Haggie said the “brain” of the Healthcare system—called Meditech–is down in a possible ransomware attack.
The management system used to store things like appointments and patient medical history appear to be in the hands of a hacker (or more than one). The Canadian Press reported on Thursday, November 11, that the attack is likely ongoing.
“Cyberattack” privacy breach may have put patients, employees in danger
In an announcement on Tuesday, November 9, officials warned that patients’ and employees’ private health records have been accessed by cybercriminals. They said individuals within Eastern, Central, and Labrador-Grenfell Health should check their credit reports.
They warned that everyone within these authorities should assume their private information has been taken. For employees, this includes name, address, contact information, and Social Insurance Number. For patients, this involves basic information typically logged or used for a patient visit, including name, address, health care number (MCP), who you are visiting, reason for visit, your doctor, phone number, birth date, email address for notifications, in-patient/out-patient, mother’s maiden name, and marital status.
“I think this is quite a serious breach,” said Eastern Health CEO David Diamond.
Government remains tight-lipped on details. Officials said they are following national instructions on how to not tip off those responsible. But they did confirm that employee and patient information reaching back 14 years was accessed in Eastern and going back nine years in Labrador-Grenfell. On Wednesday, November 10, the provincial government confirmed that patient and employee data going back 13 years in Central Health had been compromised.
Each Regional Health Authority is working differently. Data in Eastern, Central, and Labrador-Grenfell Health has been compromised. There is currently no evidence that information relating to the Newfoundland and Labrador Centre for Health Information (NLCHI) or Western Health employees or patients has been compromised.
“Things are happening” but “it’s a steady climb up a big hill,” said Minister Haggie last week.
Pat Hepditch, vice-president of the Newfoundland and Labrador Centre for Health Information says, “an unauthorized third party has compromised our system.”
Hepditch said they are working with the Newfoundland and Labrador Centre for Health Information to recover and restore what’s been hacked. “Everyone wants this done as quickly as possible, but we need to be cautious.”
“Those involved in the attack may actually be monitoring what we are saying in media and on the floor of the House [of Assembly],” Minister Haggie said.
“It’s very important, therefore, we don’t do or say anything that compromises the efforts underway to investigate and resolve this matter.”
Further Strain on Overburdened Healthcare System
For one Corner Brook mother, who asked to remain anonymous, the cyber catastrophe couldn’t come at a worse time. “It feels like we are suffocating,” she told The Independent. She took the bus to St.John’s on Saturday morning from Corner Brook, only to find out her daughter’s medical appointments were cancelled.
Jane Doe was on her way to the Janeway with her 17-year-old daughter, who was booked for exams to investigate a series of seizures, when she got the news. This came after years of waiting and fundraising to make the trip.
Thousands of Newoundlanders and Labradorians like her had their healthcare appointments cancelled or otherwise delayed indefinitely.
“It’s overwhelming,” Doe said. She is now scrambling to find accommodations. Her family was hit hard by the pandemic and has been reduced to one income. On top of that her daughter’s condition is worsening.
“She can talk to me and at the drop of a hat she’s gone.”
‘Worst Cyberattack in Canadian History’
“This target was large enough to interrogate for a weakness and it seems one was found,” said Dr. Gerard Farrell, a professor in Medicine at Memorial University of Newfoundland and Labrador. Farrell has been researching how technology can help and hinder our ability to provide health care for the last twenty years.
He told The Independent that hackers run automated checks against significant targets online until they find an opening to exploit—and then they do.
“People in emergency are going to wait even longer for care. Family doctors in the community are also unable to access basic services for their patients; that number will be more difficult to quantify. Every day this goes on, those numbers are going to multiply.”
Eastern Health continues to work with the Newfoundland and Labrador Centre for Health Information to restore the IT system.
Eastern Health CEO David Diamond said they are working with individuals to address their immediate concerns. Diamond said “there’s been significant impact” and “there’s a lot of angst.” Diamond said they’ve received dozens of calls from frustrated patients, some who have flown in from Labrador only to find cancelled appointments.
On Friday, November 5, Diamond said they will continue with urgent and emergent services while systems are slowly returning. Chemotherapy appointments are back on.
Cybersecurity professionals call what’s happening in the province the worst cyberattack in Canadian history. Experts warn that cyberattacks have evolved into sophisticated and organized crime. In an increasingly digital age, this presents added risk to systems like Newfoundland and Labrador’s health management program—and added gain for those that can break into them.
Government has emphasised that this matter is under investigation. The Newfoundland and Labrador Office of the Information and Privacy Commissioner, the Canadian Centre for Cyber Security, and the RCMP have been engaged in the process.
In the meantime, officials are advising individuals impacted to monitor their bank or financial information for unusual activity.
Did you enjoy this article? Fund more like it, and support the future of journalism in Newfoundland and Labrador.