ST. JOHN'S, N.L. — The ransomware attack that hit Newfoundland and Labrador’s health-care IT systems in 2021 was “almost an inevitability” and resulted in the theft of personal data from the “vast majority” of the province’s population, says a report released Wednesday.
The security of the province's health information system was lacking in several important areas, and officials knew about the weaknesses but did not take appropriate action to fix them, said the 115-page report from the office of the province’s information and privacy commissioner.
“We understand that sometimes mistakes happen and accidents happen … in our estimation, that is not what happened here," Sean Murray, who led the investigation, told reporters. "It was pretty clear that we did not have in this province appropriate cybersecurity measures in place in our health-care system prior to the cyberattack. And that was the major contributor to the cause of the cyberattack.”
Moreover, health officials broke provincial privacy laws by not disclosing key information within a reasonable time frame about the nature of the attack and whether information had been stolen, Murray said. They also broke privacy laws by not sufficiently protecting the information in the first place, he added.
Widespread IT outages hit the province's health-care system beginning Oct. 30, 2021, forcing doctors and nurses in a major St. John's hospital to resort to pen and paper to keep track of patients. Thousands of appointments were cancelled, including cancer care, as officials scrambled to figure out what happened and get systems up and running.
The government has been tight-lipped about what happened, and it didn't reveal until March that the attack involved ransomware — a type of malicious software used by hackers to encrypt or steal data until victims pay a ransom.
The Hive ransomware was behind the hit, Justice Minister John Hogan said at the time, adding that he could disclose the culprit because the group had been dismantled in January by the FBI and no longer posed a threat. Until then, officials had said that disclosing the nature of the attack would have compromised security.
The report said the delay in that disclosure was "concerning" and the rationale given by authorities to justify it was insufficient.
Hogan has also said that the hackers broke into the IT system of the Newfoundland and Labrador Centre for Health Information through a virtual private network that they had accessed with stolen login information. The report says an email phishing scam is most likely to blame.
The report says the hackers triggered alerts within the computer systems before they deployed their attack, which were not properly investigated. A proper investigation may have stopped the attack, or lessened its impacts, Murray wrote. His report also outlines several instances where officials had information about security vulnerabilities or were warned about the increasing risk of cyberattacks — particularly of ransomware attacks — against health-care systems.
Last December, provincial health officials said a review of a network drive accessed by the hackers showed that more than 58,000 people in the province had their data breached.
But Tuesday's report says the perpetrators also stole personal and health information from data repositories belonging to three of the province's four health authorities. Though the exact number of victims is unknown, the report says the information stolen includes at least nine years of data from each authority as well as information belonging to everyone in the province who had a COVID-19 test before 2021.
"The total number of privacy breaches caused by the cyberattack is unknown but it is likely to be in the hundreds of thousands," Murray wrote. "In other words, it is likely that the vast majority of the population of the province had some amount of personal information or personal health information taken by the cyberattackers."
Ultimately, the perpetrators managed to steal more than 200 gigabytes of data, the report says.
Problems aside, the report also notes that the province's response to the attack was “by and large carried out well." It also says "an impressive amount of work" has been done to implement proper cybersecurity measures to avoid a future attack.
The provincial Justice Department issued a statement Wednesday after Murray's news conference to say it was reviewing the report's 34 findings and six recommendations.
"This was a complex cybersecurity incident, but we are confident that reasonable security steps have already been taken — and are being taken — to mitigate the risk of a potential future incident," Hogan said in the release.
This report by The Canadian Press was first published May 24, 2023.
Sarah Smellie, The Canadian Press
