Five hospitals in Ontario, which fell victim to a ransomware attack last autumn, are initiating a mass notification effort to inform over 326,000 patients whose personal data was compromised.

The cyber breach on October 23, targeted Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital.

While electronic medical records at all affected hospitals, except Bluewater Health, remained unscathed, personal health information stored within their systems was unlawfully accessed. Subsequently, some of this pilfered data surfaced on the dark web.

A collective statement released by the hospitals highlights that approximately 326,800 patients were impacted, though this figure might include duplications for individuals seeking medical care at multiple sites.

The hospitals have undertaken a meticulous data analysis process spanning several months to ensure comprehensive notification of affected patients. For those whose social insurance numbers were compromised, arrangements for credit monitoring will also be provided.

The hospitals confirm that their notification strategy was devised in consultation with Ontario’s Information and Privacy Commissioner. Expressing regret for the disruption caused by the cyber incident, the hospitals extend their apologies to patients, communities, and healthcare professionals affected.

Apart from the hospitals, TransForm, a non-profit organization overseeing the hospitals’ IT infrastructure, was also affected by the ransomware attack. Despite the disruption to hospital operations and data breach affecting certain patient and staff information, the group opted not to meet ransom demands, based on expert advice.