Tara Jeffrey
Bluewater Health has confirmed that stolen data linked to a recent cyberattack has been published.
“We have become aware that data connected to the cyber incident has been published,” the hospital said in a statement, Thursday. “We are reviewing the data to determine its contents.”
Earlier this week, the group of hospitals impacted by the cyberattack — Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare and Windsor Regional Hospital, and their shared service provider TransForm Shared Service Organization — confirmed that certain information about patients, employees and professional staff had been stolen.
“Working with leading cybersecurity experts, we continue to investigate to determine the exact data impacted,” the statement added. “Any individuals whose data was affected by this cyberattack will be promptly notified, in accordance with the law.”
The southwestern Ontario hospitals first reported as a ‘digital systems outage’ last week before confirming the ransomware attack that disrupted operations.
“We are working closely with law enforcement – including local police departments, Ontario Provincial Police, INTERPOL and FBI – and we have notified all relevant regulatory organizations including the Ontario Information and Privacy Commissioner.
“Our leaders, on advice by our experts that we could not verify claims by the attacker, decided we would not yield to their ransom demands. We are aligned in this position with the governments of 40 nations, including Canada, who have recently pledged to never pay ransom to cybercriminals.”
The hospitals reiterated that work continues ‘around the clock’ to restore systems, “and we expect to have updates related to the restoration of our systems in the coming days.”
They added that the hospitals will continue to do their best to contact patients directly in advance if they have a scheduled appointment that needs to be rescheduled.
Patients are still being asked to seek alternative community healthcare supports and to attend their primary care provider or local clinic for any non-emergency needs.
“We understand the impact this incident is having on members of our community, including patients and our employees and professional staff, and deeply apologize for the inconvenience this has caused. We want to thank everyone for their patience during this time.”
“Due to the fact we have notified and engaged law enforcement as part of a criminal investigation, we remain limited in what we can say,” the statement adds. “We will provide more information when we are advised we are in a position to do so.”