Five Canadian hospitals, including Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital, have confirmed a data breach after falling victim to a ransomware attack. The incident also impacted TransForm Shared Service Organization, a shared drive used by these hospitals.
Bluewater Health reported that a patient database report, containing data from approximately 5.6 million patient visits by around 267,000 unique patients, was stolen, along with some employee information. The hospitals are diligently investigating the extent of the breach and have assured that no banking information was compromised.
Employee information from Chatham-Kent Health Alliance, including names, addresses, gender, dates of birth, marital statuses, social insurance numbers, and basic pay rates, was accessed by the threat actors. Erie Shores HealthCare had approximately 352 current and former employee social insurance numbers stolen.
Windsor Regional Hospital and Hôtel-Dieu Grace Healthcare also experienced limited breaches, affecting both patient and employee data, with no compromise of medical records or social insurance numbers. The hospitals are working around the clock to restore their systems, and the Ontario Information and Privacy Commissioner has been notified of the incident.
The Daixin ransomware gang has claimed responsibility for the attack and has posted data allegedly stolen from the five hospitals online. The group alleges to have exfiltrated over 160 GB of data, including thousands of personally identifiable information (PII) and protected health information (PHI) records. Investigations into the breach are ongoing, and the hospitals are committed to identifying the impacted individuals and ensuring the security and privacy of patient and employee data.
References:
