IT outage provincewide in NL: cyberattack?

ST. JOHN’S – A cyberattack appears to be behind a provincewide disruption of healthcare services in Newfoundland and Labrador that has affected thousands of appointments and procedures, including those involving COVID-19 testing.

“We may have been victims of a possible cyberattack by a third party,” said Health Minister John Haggie at a news conference.

Sources told CBC News on the weekend that the attack was ransomware, but Haggie said he can’t confirm that yet.

“The nature and extent of it are still under investigation,” he told reporters.

One thing is clear, this event has rocked the healthcare system – foremost at Eastern Health – the largest of the province’s four health authorities, where almost all procedures except emergency ones were cancelled.

“It’s been a difficult few days,” said David Diamond (pictured), Eastern Health’s CEO.

The range of what’s been affected at the health authority is wide, with no patients able to be registered and the entire email system down.

Eastern Health is now using its contingency plan to get by, one that’s effectively pushed the health authority into the past.

“[It] means we go back to a paper-based system, which is not very efficient, and slow,” said Diamond.

He couldn’t put an exact number on how many procedures – ranging from surgeries to chemotherapy to X-rays – have been affected, but estimated it to be in the thousands.

Clinical experts, he said, advised against going ahead with most appointments using the paper-based system for safety reasons.

“It is a significant impact, there’s no doubt about that, and the numbers would be quite large,” Diamond said. “Eastern Health delays affect patients across the province, because people come to the St. John’s area for specialist appointments.”

Western Health and Labrador-Grenfell Health appear to have escaped much of the damage, while Central Health is moderately affected, said Haggie.

Some tests requiring samples to be processed in the Eastern Health region will need to be rescheduled, and anyone needing COVID-19 testing in the Western Health area is asked to call a toll-free number.

Haggie said his department has recommended that COVID-19 testing move away from electronic and phone bookings toward a drop-in basis. The online portal that gives people their test results has been affected, and Haggie said public health officials will notify by telephone of positive results.

Vaccination clinics are unaffected by the outages.

Patients with procedures going ahead despite the issues will be contacted, said Diamond. For the rest, phone lines and web portals have been set up for rescheduling.

Diamond said dealing with the cancellations may require staff to put in extra hours on evenings and weekends. The system has overcome recent backlogs stemming from COVID-19 lockdowns and snowstorms, with those experiences being helpful in addressing the current one.

Haggie said the Newfoundland and Labrador Centre for Health Information – which handles IT needs for the province, including electronic health records – and telecommunications company Bell Aliant are working on the problem, but there is no clear timeline yet for when things will return to normal.

There are more questions than answers at this point as to what happened, and the extent of the damage.

Haggie said they “have no information one way or another” about whether patients’ personal information has been compromised.

The office of the privacy commissioner has been notified, he said, and a slate of organizations and bodies outside the provincial government have been looped in, including Health Canada, the province’s healthcare insurer, and law enforcement agencies.

One cybersecurity expert said ransomware attacks have been known to hit healthcare services.

“These types of attacks are very virulent,” said Steve Waterhouse, a former information systems security officer with the Department of National Defence, based in Montreal.

“As we speak, they go across the world, and especially they attack health services systems, for the purpose of inducing those health services to pay rapidly to recover access to their systems so they can continue serving the population.”

Ransomware attacks use malicious software to block or encrypt files, with a ransom payment demanded in order to restore access.

Source: CBC News