Brunswick Medical Centre, a clinic on Montreal’s West Island, says it was the victim of a cyberattack on March 24 that exposed the personal information of patients, employees, and physicians.
The clinic notified patients on social media Thursday, saying it had waited to go public in order to contain the threat, secure its systems, and continue providing care.
Some patients of the clinic confirmed that they only found out about the breach on Friday.
“We didn’t get any notifications by email. We weren’t advised. So, I’m not even sure who was affected, if it was everybody or not,” said patient Myriam Naccache.
Following the attack, the medical group hired cybersecurity experts to contain the incident and conduct an investigation, which is ongoing.
“We can confirm that an unauthorized actor accessed and took personal information and health information of members of our community from our servers,” the clinic said.
“Our employees and professionals have been directly notified of the incident. We will provide an update as soon as our data analysis allows.”
The clinic added that most patient data was not affected.
Cybersecurity expert Terry Cutler told CTV News that every single patient should have been contacted.
“We don’t know what kind of data was taken out. It could have been the email addresses of all the patients.”
“So, what’s going to happen here is that the cybercriminals are going to email every one of these patients and try and trick them into clicking on a link that they are not supposed to,” he said.
Cutler added that hackers can then infect home computers, lock people out of their accounts, and hold them hostage until they pay a ransom.
In a statement, Vince Trevisonno, the CEO of Brunswick Medical Centre, said the clinic does not yet know the total number of patients affected or what health information was accessed.
He added that they are not aware of any data being leaked or sold.
Moreover, he said Omnimed — the external platform that stores Electronic Medical Record data, including health insurance numbers, phone number and email addresses — was not compromised during the breach.
“Other groups of individuals may also have been impacted, and we will ensure they are notified as soon as our analysis allows,” it said.
The clinic said it alerted authorities, including the Commission d’accès à l’information, Santé Québec, the Ministry of Health and Social Services, the Quebec College of Physicians, the West Island health authority and law enforcement.
It also said “comprehensive measures” have been implemented to contain the incident and to prevent it from happening again.
Some appointments in the endoscopy department had to be temporarily postponed for one day due to the incident.
With files from CTV News Montreal’s Maria Sarrouh
