Members of the public among those affected by massive N.S. cyberattack
The Nova Scotia government revealed Friday that cyber criminals made off with the private information of tens of thousands of people, including high school students, short-term accommodation owners, newborns and people issued parking tickets in the Halifax Regional Municipality.
On Friday, the province gave details on 94,574 of the records stolen in a cyberattack identified last week, and the total number of records stolen may climb.
On Tuesday, the province's Minister of Cyber Security and Digital Solutions, Colton LeBlanc, said current and past employees of Nova Scotia Health, the IWK Health Centre and the provincial civil service have also been impacted.
On Friday he confirmed members of the public outside of those groups were also affected.
"Today I can provide more specifics on our findings to date, clarify some of the groups within government who were impacted and how," said LeBlanc during a virtual briefing to reporters Friday afternoon.
Those details did not include any additional information on what might have been taken from current and past employees of Nova Scotia Health, the IWK or civil service.
LeBlanc says those whose information was stolen will be notified by mail or e-mail, starting next week, and that some people may get multiple messages.
"What we're realizing throughout our investigation is that one individual could be impacted through (multiple) breaches," said LeBlanc.
"For example, a teacher could also be former employee of the civil service, could also have had a parking ticket through HRM."
"Those are three instances where we've identified [as] compromised."
Although the group thought to be responsible this data theft is a notorious ransomware group, Leblanc said the "cyber criminals" had not contacted the province to try to extort money.
"The organization that has claimed to be leading this cyber attack is a group of organized criminals," said LeBlanc. "The day that government starts doing business with organized crime we [would] certainly have to be reconsidering our priorities as a province.
"We will not be engaging with cyber criminals."
British Airways, the UK drugstore chain Boots and Britain's BBC have also been hacked by criminals exploiting a weakness in the same MOVEit file transfer software used in Nova Scotia, Reuters news service reported Monday. According to the province, it pays $30,000 per year to license and use the MOVEit software.
Microsoft security experts have said the hackers are affiliated with the notorious ransomware group dubbed Clop. The Canadian Press reported Wednesday that the hacker gang says it has deleted the data from governments but private companies have until June 14 to contact the group to negotiate a ransom. However cybersecurity experts say the province should be suspicious of that claim.
According to investigators, those who are victims of this attack include:
About 55,000 records of past and present teachers in Nova Scotia, including name, address, date of birth, years of service and educational background. The information does not include social insurance numbers or banking information. The list includes people born in 1935 or later.
About 26,000 students, aged 16 years and older, including home address, date of birth, gender, student ID and school. This information was in the database because it was shared with Elections Nova Scotia.
About 5,000 short-term accommodations owners in the Tourist Accommodations Registry. The information stolen included name, owner's address, property address and registration number.
About 3,800 people who applied for jobs with Nova Scotia Health, including their demographic data and employment details. Social insurance numbers were not included.
About 1,400 Nova Scotia pension plan recipients. Their names, social insurance numbers, dates of birth and demographic data were stolen.
1,085 people issued Halifax Regional Municipality parking tickets. Names, addresses and licence plate numbers were stolen.
About 500 people in provincial adult correctional facilities; name, date of birth, gender, prisoner ID number and status in the justice system were stolen.
About 100 Nova Scotia Health vendors, including product and pricing information. Vendors' banking information does not appear to be included.
54 people issued summary offence tickets; names, driver's licence numbers and dates of birth were stolen.
54 clients of the Department of Community Services, including names, addresses, client ID and transit pass photos.
About 1,330 people in the Department of Health and Wellness client registry, including name, address, date of birth, and health card number.
At least 150 people in the Department of Health and Wellness provider registry, including doctors, specialists, nurses and optometrists. Assessments are ongoing. The information taken includes names, addresses and dates of birth. It does not include social insurance number or banking information.
About 60 people with the Prescription Monitoring Program, including names, addresses, dates of birth, health card numbers and personal health information.
41 newborns born between May 19 and 26. Information stolen includes last name, health card number, date of birth and date of discharge. Parents will be notified.
MORE TOP STORIES
