Cyber-attack steals info about BC health workers

VANCOUVER – A cyber-attack on three websites hosted by the Health Employers Association of British Columbia may have seized the personal information of thousands of people working or applying to work in B.C.’s public healthcare sector. Michael McMillian (pictured), CEO of the association, said stolen information could include social insurance numbers, home addresses, passport and driver’s licence details, along with other personal information. He said 240,000 email addresses alone were possibly taken.

CBC News reported that the cyberattack targeted three websites recruiting physicians, nurses and other health professionals: Health Match B.C., Locums for Rural B.C. and the B.C. Care Aide & Community Health Worker Registry.

B.C. has been on a major recruitment drive to attract desperately needed healthcare workers to the province.

One of the compromised sites was used to recruit physicians, registered nurses and other health professionals on behalf of health employers. The others helped with vacation coverage for rural doctors and registered care aides working in places including long-term care facilities.

“I sincerely regret this event happened and I want to reassure everyone that we are working with cybersecurity and privacy experts to address the incident,” said McMillian.

“We know that not all of the information in the potentially affected databases was taken, however, at this time we are not able to conclusively determine which information was involved,” he said.

Individual health records have not been affected and the breach is not associated with a ransomware attack, according to McMillian. For now, anyone wanting to register for the programs won’t be able to do so online but can contact the programs directly, he added.

In the aftermath of the cyberatttack, a message on the BCHEA website says the affected websites are down for maintenance. (BCHEA)

The CEO said the association will reach out to everyone whose information may have been compromised over the next few days to offer them two years of monitoring by the credit agency Equifax.

The attack was detected on July 13, although McMillian says the hackers responsible were found to have been in the system between the dates of May 9 to June 10.

The three programs affected continue to operate but with the public-facing websites down, new applicants must contact administrators directly to register.

“This is not as efficient, but these temporary measures will enable potential health-care workers the opportunity to continue to apply and come work in our province,” said Health Minister Adrian Dix.