The ransomware attack that hit Newfoundland and Labrador’s health-care IT systems in 2021 was “almost an inevitability” and likely resulted in the theft of personal data from the “vast majority” of the province’s population, says a report released Wednesday.
Health officials also broke provincial privacy laws by not disclosing key information within a reasonable time frame about the nature of the attack and whether information had been stolen, concludes the 115-page report from the office of the province’s information and privacy commissioner.
“We understand that sometimes mistakes happen and accidents happen … in our estimation, that is not what happened here,“ Sean Murray, the report’s author, told reporters. ”It was pretty clear that we did not have in this province appropriate cybersecurity measures in place in our health-care system prior to the cyberattack. And that was the major contributor to the cause of the cyberattack.”
The report also said the hackers triggered alerts within the computer systems before they deployed their attack, which were not properly investigated. A proper investigation may have stopped the attack, or lessened its impacts, Murray wrote.
Widespread IT outages hit the province’s health-care system beginning Oct. 30, 2021, forcing doctors and nurses in a major St. John’s hospital to resort to pen and paper to keep track of patients. Thousands of appointments were cancelled, including cancer care, as officials scrambled to figure out what happened and get systems up and running.
The government has been tight-lipped about what happened, and it didn’t reveal until March that the attack involved ransomware—a type of malicious software used by hackers to encrypt or steal data until victims pay a ransom.
The Hive ransomware was behind the hit, Justice Minister John Hogan said at the time, adding that he could disclose the culprit because the group had been dismantled in January by the FBI and no longer posed a threat. Until then, officials had said that disclosing the nature of the attack would have compromised security.
The report said the delay in that disclosure was “concerning” and the rationale given by authorities to justify it was insufficient.
Hogan has also said that the hackers broke into the IT system of the Newfoundland and Labrador Centre for Health Information through a virtual private network that they had accessed with stolen login information. The report says an email phishing scam is most likely to blame.
Last December, provincial health officials said a review of a network drive accessed by the hackers showed that more than 58,000 people in the province had their data breached.
But Tuesday’s report says the perpetrators also stole personal and health information from data repositories belonging to three of the province’s four health authorities. Though the exact number of victims is unknown, the report says the information stolen includes at least nine years of data from each authority as well as information belonging to everyone in the province who had a COVID-19 test before 2021.
“The total number of privacy breaches caused by the cyberattack is unknown but it is likely to be in the hundreds of thousands,” Murray wrote. “In other words, it is likely that the vast majority of the population of the province had some amount of personal information or personal health information taken by the cyberattackers.”
Problems aside, the report also notes that the province’s response to the attack was “by and large carried out well.“ It also notes that ”an impressive amount of work” has been done to implement proper cybersecurity measures to avoid a future attack.
The provincial Justice Department issued a statement Wednesday after Murray’s news conference to say it was reviewing the report’s 34 findings and six recommendations.
“This was a complex cybersecurity incident, but we are confident that reasonable security steps have already been taken—and are being taken—to mitigate the risk of a potential future incident,” Hogan said in the release.
