B.C.’s First Nations Health Authority (FNHA) says a ransomware gang attacked their corporate network on Monday, May 13.
Inc Ransomeware, a group of cybercriminals, is purporting to have an unspecified amount of the health authority’s data, uploading to their website some evidence, including files on:
- The FHNA budget
- Procurement contracts
- Contracts with businesses
- Cheques paid to First Nations
- Security logs
- Patient contact information
- Patient GroupNet billing data
“They hack their way into a network,” said Brett Callow, threat analyst with Emsisoft. “They will steal a copy of the information then lock and encrypt the computers from which the information is stolen.”
FHNA says in a statement they took immediate action to intercept the unauthorized entity which had gained access to their corporate network.
“We immediately deployed countermeasures to block the unauthorized entity’s access and prevent any further unauthorized activity. There was no encryption of FNHA’s servers or systems as a result,” reads the statement.
“While the investigation is still at an early stage, FNHA has uncovered evidence that certain employee information and limited personal information of others has been impacted,” the statement adds.
Story continues below
B.C.’s Health Minister tells CHEK News that there’s no evidence of larger government or health authority systems that contain patient medical records were compromised.
It’s the latest in a series of cyber attacks in B.C. in the past month.
The first was London Drugs, which was forced to shut its stores for a week in late April after Russian cybercriminals known as LockBit demanded ransom for their data.
On May 10, the province went public saying it had been targeted three times in what it called a ‘sophisticated’ cybersecurity attack. The organization responsible, they say, was directed by an unnamed foreign state.
“We have reason to believe that the attack was a state, or [a] state-sponsored actor was involved in these cyber attacks,” said Mike Farnworth, B.C.’s Minister of Public Safety in a press conference on May 10.
FNHA says it has no evidence that this cyber incident is in any way connected to other cyber incidents in B.C. that have recently received media attention.
“FNHA also immediately engaged third-party cybersecurity experts to assist with containment and remediation and to conduct a forensic investigation to determine the extent and scope of this incident. We have also reported this incident to law enforcement and to the Office of the Information and Privacy Commissioner of British Columbia,” FHNA said in a statement.
Callow says while it’s hard to say if cyber attacks are increasing in B.C., the scale of hackers holding data for ransom globally is massive.
“More than a billion in dollars is known to be paid last year, so this is very big business,” said Callow.
LockBit has been the most prolific ransomware gang, extorting $120 million from thousands of victims around the world. In 2022, the group attacked Canada’s largest pediatric health centre shortly before Christmas, causing diagnostic and treatment delays. A September attack against two New York hospitals forced them to divert ambulances and reschedule most appointments.
In February, law enforcement hacked the hackers, infiltrating and disrupting LockBit, arresting two people in Poland and Ukraine and seizing 200 cryptocurrency accounts.
Callow says refusing to pay, like London Drugs has publicly said it’s done, is the right thing to do.
“But today London Drugs were removed from LockBit’s website. Why they were removed I cannot say. But I can say LockBit removes company’s that pay or are willing to negotiate,” said Callow.
When asked if they had paid the ransom, London Drugs referred CHEK News to their prior statements saying they had refused.
FNHA tells CHEK News there is no evidence the cyber incident impacted any clinical information systems it uses.
Kori Sidaway
