November 7, 2023 at 07:00AM
Five Canadian hospitals, including Bluewater Health and Windsor Regional Hospital, have confirmed a data breach resulting from a ransomware attack. Patient and employee data, including social insurance numbers, was stolen and leaked online. The hospitals are working to identify and notify affected individuals. The Daixin ransomware gang has claimed responsibility and posted stolen data online. The incident has been reported to the Ontario Information and Privacy Commissioner.
Meeting Takeaways:
1. Five Canadian hospitals, Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital, along with service provider TransForm Shared Service Organization, have confirmed a data breach resulting from a ransomware attack.
2. The breach involved a compromised shared drive that contained patient and employee data.
3. Bluewater Health reported that approximately 5.6 million patient visits made by approximately 267,000 unique patients were stolen, along with some employee data.
4. Chatham-Kent Health Alliance had 1,446 employee records compromised, including names, addresses, gender, dates of birth, marital statuses, social insurance numbers, and basic pay rates.
5. Erie Shores HealthCare had patient data stolen, along with approximately 352 current and past employee social insurance numbers.
6. Limited patient and employee information from Windsor Regional Hospital and Hôtel-Dieu Grace Healthcare was accessed, but no medical records or social insurance numbers were compromised.
7. No banking information was stolen in the attack.
8. The Ontario Information and Privacy Commissioner has been notified of the incident.
9. The Daixin ransomware gang has claimed responsibility for the attack and has posted online data allegedly stolen from the hospitals.
10. The group claims to have exfiltrated over 160 GB of data, including personally identifiable information and protected health information records.
11. In October last year, the US cybersecurity agency CISA and the FBI warned healthcare organizations of the risk associated with the Daixin ransomware.