Cyber attack continues to cripple CKHA

Michael Bennett, Local Journalism Initiative Reporter, The Ridgetown Independent NewsThe investigation into the cyber attack that continues to cripple communications at the Chatham-Kent Health Alliance has expanded to an international search. The Federal Bureau of Investigation and Interpol have joined local police and the Ontario Provincial Police to find the culprits and the depth of the ransomware attack on the CKHA and four other regional hospitals. Patient, employee and professional staff data at Bluewater Health in Sarnia, Erie Shores HealthCare in Leamington, Hotel-Dieu Grace Healthcare and Windsor Regional Hospital, and the CKHA, may have been compromised. The Hospital Group reported on Oct. 23 that its shared service provider -- TransForm Shared Service Organization -- was victimized by a cyber attack, and personal information has been shared. "We have become aware that data connected to the cyber incident has been published,'' read a joint media release from the Hospital Group. "Working with leading cyber security experts, we have determined through our investigation that, unfortunately, certain patient, employee and professional staff data has been taken, and there is the possibility that the actors responsible for this attack may publish some of the stolen data. We continue to investigate to determine the exact data impacted, and any individuals whose data was affected by this cyber attack will be notified in accordance with the law.'' As the Hospital Group continues to work with local and international police services, it has notified all relevant regulatory organizations, including the Ontario Information and Privacy Commissioner. "On advice by our experts that we could not verify claims by the attacker, our leaders decided we would not yield to their ransom demands,'' the statement read. "We are aligned in this position with the governments of 50 nations, including Canada, who have recently pledged never to pay ransom to cyber criminals.'' The Windsor Star reported on Nov. 2 that Daixin Team, an organized cybercrime gang, has claimed responsibility for stealing millions of records from five southern Ontario hospitals and leaking them online after officials would not submit to ransom demands. Hackers reportedly targeted TransForm, a not-for-profit shared service organization founded by the five hospitals in the Erie St. Clair region to manage their hospital information technology. The cyber attack on Transform infiltrated the hospitals' technology systems as their access to Wi-Fi, email and patient information systems was blocked. The CKHA and the other regional hospitals continue to work around the clock to restore their systems. The shared media release states the hospitals are continuing "to do their best'' to contact patients directly in advance if they have a scheduled appointment that needs to be rescheduled. Residents are also encouraged only to attend an Emergency Department if it is a true emergency. If you are needing care for a health issue that is not an emergency, you are asked to attend your primary care provider or a local clinic to reduce the impact in the hospital's ED to allow staff to focus on those needing hospital care. "We understand the impact this incident is having on members of our community, including patients and our employees and professional staff, and deeply apologize for the inconvenience this has caused,'' the media statement read. "Due to the fact we have notified and engaged law enforcement as part of a criminal investigation, we remain limited in what we can say. We will provide more information when we are advised we are in a position to do so.'' And as if the CKHA isn't busy enough dealing with the cyber attack, it was also the victim of an unrelated threat that led to partial lockdowns of both Chatham and Wallaceburg campuses on Oct. 26. The Chatham-Kent Police Service responded to a threat received by the CKHA around 9:45 a.m. The CKPS, in collaboration with the CKHA security team, ensured the safety of all individuals in the facilities. At 11:44 a.m., a 47-year-old Highgate man was located at his home and taken into custody without incident. The CKHA lifted its partial lockdowns after the arrest was made. No other details on the type of threat or how it was communicated have been released.

The investigation into the cyber attack that continues to cripple communications at the Chatham-Kent Health Alliance has expanded to an international search.

The Federal Bureau of Investigation and Interpol have joined local police and the Ontario Provincial Police to find the culprits and the depth of the ransomware attack on the CKHA and four other regional hospitals. Patient, employee and professional staff data at Bluewater Health in Sarnia, Erie Shores HealthCare in Leamington, Hotel-Dieu Grace Healthcare and Windsor Regional Hospital, and the CKHA, may have been compromised.

The Hospital Group reported on Oct. 23 that its shared service provider — TransForm Shared Service Organization — was victimized by a cyber attack, and personal information has been shared.

“We have become aware that data connected to the cyber incident has been published,” read a joint media release from the Hospital Group. “Working with leading cyber security experts, we have determined through our investigation that, unfortunately, certain patient, employee and professional staff data has been taken, and there is the possibility that the actors responsible for this attack may publish some of the stolen data. We continue to investigate to determine the exact data impacted, and any individuals whose data was affected by this cyber attack will be notified in accordance with the law.”

As the Hospital Group continues to work with local and international police services, it has notified all relevant regulatory organizations, including the Ontario Information and Privacy Commissioner.

“On advice by our experts that we could not verify claims by the attacker, our leaders decided we would not yield to their ransom demands,” the statement read. “We are aligned in this position with the governments of 50 nations, including Canada, who have recently pledged never to pay ransom to cyber criminals.”

The Windsor Star reported on Nov. 2 that Daixin Team, an organized cybercrime gang, has claimed responsibility for stealing millions of records from five southern Ontario hospitals and leaking them online after officials would not submit to ransom demands.

Hackers reportedly targeted TransForm, a not-for-profit shared service organization founded by the five hospitals in the Erie St. Clair region to manage their hospital information technology. The cyber attack on Transform infiltrated the hospitals’ technology systems as their access to Wi-Fi, email and patient information systems was blocked.

The CKHA and the other regional hospitals continue to work around the clock to restore their systems.

The shared media release states the hospitals are continuing “to do their best” to contact patients directly in advance if they have a scheduled appointment that needs to be rescheduled.

Residents are also encouraged only to attend an Emergency Department if it is a true emergency. If you are needing care for a health issue that is not an emergency, you are asked to attend your primary care provider or a local clinic to reduce the impact in the hospital’s ED to allow staff to focus on those needing hospital care.

“We understand the impact this incident is having on members of our community, including patients and our employees and professional staff, and deeply apologize for the inconvenience this has caused,” the media statement read. “Due to the fact we have notified and engaged law enforcement as part of a criminal investigation, we remain limited in what we can say. We will provide more information when we are advised we are in a position to do so.”

And as if the CKHA isn’t busy enough dealing with the cyber attack, it was also the victim of an unrelated threat that led to partial lockdowns of both Chatham and Wallaceburg campuses on Oct. 26. The Chatham-Kent Police Service responded to a threat received by the CKHA around 9:45 a.m.

The CKPS, in collaboration with the CKHA security team, ensured the safety of all individuals in the facilities.

At 11:44 a.m., a 47-year-old Highgate man was located at his home and taken into custody without incident.

The CKHA lifted its partial lockdowns after the arrest was made.

No other details on the type of threat or how it was communicated have been released.

The Local Journalism Initiative (LJI) is a federally funded program to add coverage in under-covered areas or on under-covered issues. This content is created and submitted by participating publishers and is not edited. Access can also be gained by registering and logging in at: https://lji-ijl.ca.

Learn more about our News Monitoring here.