Why you should think twice about ignoring the N.L. health-care system data breach
Take steps to protect yourself, says one expert
Thousands of patients and employees have had their personal information stolen in the cyberattack on the Newfoundland and Labrador health-care system.
That information includes names, contact details and, for employees and some patients, social insurance numbers; however, as recently as Tuesday, Justice Minister John Hogan said there is no evidence the stolen information has been misused.
So if there is no evidence that their information has been misused, should patients and employees be concerned?
According to Al Antle, the executive director of Credit Counselling Services of Newfoundland and Labrador, the answer is a resounding yes.
"This is serious business," Antle said in an interview with CBC News. "There are billions of dollars defrauded in this country every year. We need to see the seriousness of the situation and we need to protect ourselves from it."
Antle says the information stolen in the attack could easily be misused for crimes like identity theft, and those affected should carefully consider their potential risk level.
Who is affected?
Eastern Health, Central Health and Labrador-Grenfell Health all experienced security breaches affecting patients and employees. Western Health did not experience a breach itself, but registration information belonging to patients who received a COVID-19 test or a laboratory test — such as blood work — processed through Eastern Health has also been compromised.
For patients, that information includes name, address, health-care number (MCP), reason for visit, the health-care provider, phone number, birth date, email address for notifications, in-patient/out-patient status, maiden name and marital status.
Social insurance numbers belonging to 2,514 patients across Eastern Health, Central Health and Labrador-Grenfell Health were also stolen, though only 1,025 of those patients are still living. The regional health authorities are contacting those patients individually.
Stolen employee information includes contact information and social insurance numbers.
The date range for the security breach varies depending on the jurisdiction.
-
In Eastern Health, patient data going back 11 years and employee data going back 28 years has been accessed.
-
In Central Health, patient data going back 15 years and employee data going back 28 years has been accessed.
-
In Western Health, patient data going back 11 years has been accessed — though only patients who have received a COVID-19 test or a laboratory test through Eastern Health are part of the breach.
-
In Labrador-Grenfell Health, patient and employee data going back eight years has been accessed.
What's the big deal?
Antle said the list of stolen patient and employee information is "the basic stuff of which horror stories are written."
"The criminals can use that information to … benefit them in their underhanded work."
He said those who have had their social insurance numbers stolen should be especially concerned.
"The one thing that identifies you first and foremost is your social security number," he said. "If I were a thief and I was trying to steal somebody's identity, that would be … a wonderful place to start."
Antle said identities belonging to deceased patients and employees could be stolen, and estates could be negatively affected. CBC News has asked the provincial government how it is addressing the situation regarding information belonging to deceased patients.
The provincial government is offering free credit monitoring to those who have had their information stolen, but uptake has been slow so far. As of last Friday, fewer than 300 individuals in Eastern Health had availed of the service.
Antle said it's a good idea to sign up, especially for those who have had their SIN taken.
"A credit monitoring service will be, for want of a better word, a red flag if anything odd starts to happen in your financial life," he said.
How credit monitoring works
The government is offering two years of free credit monitoring to patients whose social insurance numbers have not been stolen, and five years of credit monitoring to patients and employees whose social insurance numbers were stolen in the attack.
More information about how to avail of the service can be found on each regional health authority website.
Julie Kuzmic, a senior compliance officer with Equifax Canada, said it's standard for an organization or institution that has experienced a breach to offer free credit monitoring services to the potential victims. CBC News has asked the government how much it is spending on the service.
Kuzmic said she wouldn't necessarily equate being a victim of the data breach with being a victim of identity fraud; however, she said it's a good idea for people to take steps to protect themselves.
She said the credit monitoring service will keep an eye on the credit report of anyone who signs up, and notify them if anything goes array.
"That gives you an opportunity to get in there, find out what's going on and do something about it, if it is fraudulent activity, much earlier in the process, rather than having that awful experience of discovering down the line that something has happened," she said.