As Hackers Take Down Newfoundland’s Health Care System, Silence Descends

For many months now, the residents of Newfoundland and Labrador have had to put up with canceled or delayed medical procedures and appointments. For a long time — like people in the rest of Canada, and around the world — their predicament was due to the pandemic.

But lately, the trouble has come from a new source — a catastrophic cyberattack. The system ground to a halt on Oct. 30. On Friday, the province’s four health authorities were predicting that treatment delays and disruptions would begin easing on Monday, although they would persist in some emergency departments and not all elective surgeries and chemotherapy treatments would return to normal.

And this week, the province revealed that the attack was worse than previously reported. On Friday, John Hogan, the provincial justice minister, said that employee information at three local health authorities had been stolen. Two days earlier, officials said that personal information of patients and health care workers, some of it health-related, had been “accessed” during the attack.

It was, in short, a cyberattack that theoretically affected everyone in the province.

But good luck finding out what happened or what’s going on to remedy it. The government of Premier Andrew Furey, who is also an orthopedic surgeon, won’t even describe the variety of the cyberattack.

“Our advice from world-class experts is to say nothing,” John Haggie, Newfoundland’s health minister, told a news conference on Wednesday. Nor will the government reveal who those experts are that the province brought in to solve its problem.

The Canadian Broadcasting Corporation, without revealing its source, reported that the shutdown was the latest in a string of ransomware attacks that have hit other health-related institutions, corporations and governments during the pandemic. Such attacks developed about a decade or so ago. The attacks, which appear to often come out of Russia, simply involve seizing control of data on vulnerable computer systems, encrypting it and then threatening to destroy it unless a ransom is paid, usually in bitcoin.

Three hospitals in Ontario were victims of such attacks in October 2019.They have disrupted individuals’ personal computers, and early this year they created diesel and jet fuel shortages in the United States after a pipeline company fell victim to hackers.

I spoke with Nicolas Papernot, an assistant professor of computer science and computer engineering at the University of Toronto. While he is an internationally known expert on cybersecurity and privacy, he’s not among Newfoundland’s advisers and has no inside knowledge of its situation.

“I don’t know why they don’t give more information,” he said. “But they should at least give a warning to people who are potentially affected, even if they are conservative in how they estimate whether a person was or was not impacted by the leakage of information.”

The computer networks of provincial and regional health care systems in Canada are particularly susceptible to hackers because they generally contain large numbers of outdated “legacy” software systems, Professor Papernot said.

“Those tend to carry vulnerabilities that have been patched in newer systems but that can still be exploited because these systems are too old to be maintained at current security standards,” he said.

Compounding the threat has been the mass move to working from home, he added. Many governments and corporations have yet to address the security threats posed by remote access, failing to put into place additional security measures, like two-factor identification, or training employees on spotting malicious email.

Newfoundland’s mess appears to be the largest disruption any health system has seen in Canada. But other governments have not been immune to major cyberattacks. Ten years ago, workers in the federal government’s department of finance and its treasury board were without internet access for months following a cyber attack.

That same year, the Communications Security Establishment, the highly secretive eavesdropping service, was pulled out of the military and made into a separate agency. It currently operates the Canadian Centre for Cyber Security, which, among other things, looks for threats to governments and corporations in Canada and offers advice on security.

In an email, Ryan Foreman, a spokesman for the agency, told me that it has “noticed an increase in cyber threats related to the Covid-19 pandemic, including threats directed against the country’s frontline health care and medical research facilities,” and that it has been working closely with security officials in health systems.

The cybersecurity agency confirmed that it is providing Newfoundland with digital forensics services, data recovery and general guidance. The Royal Canadian Mounted Police, it said, is also investigating the attack.

But what, exactly, is going on there? “We are unable to comment further on the nature of our assistance with the province due to operational security reasons,” the spokesman wrote.

Trans Canada

• The land border between Canada and the United States reopened this week and Canada’s snowbirds poured across it. Canada’s Covid testing requirement, however, has dampened enthusiasm for day trips. Separately this week, Health Canada gave the go ahead for booster shots of the Pfizer-BioNTech vaccine and broadened eligibility to anyone over the age of 18.

• Tracey Deer was just 12 years old in 1990 when she crouched down in a car while being evacuated from Kanesatake First Nation as a white mob hurled stones and racial insults. Ms. Deer, a film director who is Mohawk, discussed with Laurel Graeber how she turned a fictionalized version of her experience of Oka Crisis into “Beans,” her first narrative feature, which was named best picture at the Canadian Screen Awards this year and has collected more than 20 prizes on the film festival circuit.

• Skyler Williams, an ironworker from the Six Nations of the Grand River in Ontario who helped organize last weekend’s climate protest in Toronto, has little time for the United Nations global climate summit that went into overtime Friday in Glasgow: “I think we are wasting time, money, resources, flying all of these leaders to all of these climate things, environment things.”

• A hand signal developed in Canada led to the rescue of a girl reported missing in North Carolina.

A native of Windsor, Ontario, Ian Austen was educated in Toronto, lives in Ottawa and has reported about Canada for The New York Times for the past 16 years. Follow him on Twitter at @ianrausten.

How are we doing?
We’re eager to have your thoughts about this newsletter and events in Canada in general. Please send them to [email protected].

Like this email?
Forward it to your friends, and let them know they can sign up here.