B.C. Health Minister Adrian Dix speaks during an announcement, in Vancouver, B.C., Friday, June 9, 2023. THE CANADIAN PRESS/Darryl Dyck
VANCOUVER – A cyberattack on three websites hosted by the Health Employers Association of British Columbia may have seized personal information associated with 240,000 email addresses of health-care workers.
Michael McMillian, CEO of the association, said information obtained could include social insurance numbers, email addresses, passport and licence details and other personal data.
He said the affected server hosted websites for Health Match BC, the BC Care Aide and Community Health Worker Registry, and the Locums for Rural BC program.
“I sincerely regret that this event happened,” he said during a news conference on Tuesday.
McMillian said they’ll be reaching out to everyone whose information may have been compromised and will offer them two years of monitoring by the credit agency Equifax.
Investigators cannot “conclusively determine” which information may have been stolen but caution demanded that they assume all information on the affected server had been compromised, he said, although no health records were obtained.
McMillian said they learned of the hacking on July 13 and established that the hackers were “in the system” from May 9 to June 10.
One of the sites comprised was used to recruit physicians, registered nurses and other health professionals on behalf of health employers.
Health Minister Adrian Dix the said the government won’t let the cyberattack slow its recruitment progress.
“I assure everyone considering applying that your information will be protected. HEABC is committed to strengthening their IT security protocol and has put in place the necessary resources to support everyone potentially affected by this attack in the weeks and months to come.”
McMillian said police, the Office of the Information and Privacy Commissioner for B.C., the Health Ministry and the Canadian Centre for Cybersecurity have been informed of the breach.
He said the potentially compromised information has all been transferred to a “clean server” with extra security.
It wasn’t yet possible to determine how many people’s information may have been taken, since some used multiple email addresses, he said.
No ransom demand regarding the attack had been received, McMillian added.
The Health Employers Association is the bargaining agent for 200 publicly funded health-care employers, representing 170,000 unionized workers, including physicians, nurses, health science workers and paramedics.
This report by The Canadian Press was first published Aug. 1, 2023.
