The Chatham-Kent Health Alliance and four other hospitals in the region are being given some credit for efforts to keep patients and the community informed in the wake of a crippling cyber-attack.
The Information and Privacy Commissioner of Ontario has now completed its investigation into the October 2023 ransomware attack. The private information of 300,000 individuals was stolen; network servers at CKHA, Bluewater Health, Erie Shores HealthCare, Hotel-Dieu Grace Healthcare, Windsor Reginal Hospital, and the Tilbury District Family Health Team were encrypted; and when a ransom wouldn’t be paid, the private patient information was published online.
According to the IPC report, the “threat actor” infiltrated the TransForm Shared Service Organization network by leveraging three compromised administrator accounts associated with the network.
The investigator did express concern about the notification of affected patients, but said in light of measures taken to contain, investigate, and remediate the incident, any further review or orders under the Personal Health Information Protection Act are warranted.
In a written joint statement, officials from the five hospitals say they appreciate the IPC’s thorough investigation.
“We are specifically pleased that the IPC has acknowledged the efforts by the hospitals and TransForm Shared Service Organization to contain the breach after it occurred, as well as improvements made in our data and information protections since the time of the ransomware cyberattack. We acknowledge that the IPC has noted concern surrounding the notification of individuals whose data was encrypted by the threat actors. In response to this incident, the hospitals issued regular news releases describing the impact on data and operations, participated in multiple press conferences, and directly notified more than 300,000 individuals of the incident.”
Officials say due to ongoing litigation, they are unable to make further comment at this time.
