A cyberattack appears to be behind a provincewide disruption of health-care services in Newfoundland and Labrador that has affected thousands of appointments and procedures, including those involving COVID-19 testing.
“We may have been victims of a possible cyberattack by a third party,” said Health Minister John Haggie at a news conference Monday morning.
The possible attack first made itself felt Saturday morning, and hit “the brain of the data centre” that powers the province’s health-care system, said Haggie.
“We have a system that is damaged,” he said.
Sources told CBC News the attack was ransomware, but Haggie said he can’t confirm that yet.
“The nature and extent of it are still under investigation,” he told reporters.
One thing is clear: the weekend’s events have rocked the health-care system, foremost at Eastern Health, the largest of the province’s four health authorities, where almost all procedures except emergency ones have been cancelled.
“It’s been a difficult few days,” said David Diamond, Eastern Health’s CEO.
The range of what’s been affected at the health authority is wide, with no patients able to be registered and the entire email system down.
Back to paper
Eastern Health is now using its contingency plan to get by, one that’s effectively pushed the health authority into the past.
“[It] means we go back to a paper-based system, which is not very efficient, and slow,” said Diamond.
He couldn’t put an exact number on how many procedures — ranging from surgeries to chemotherapy to X-rays — have been affected, but estimated it to be in the thousands.
Clinical experts, he said, advised against going ahead with most appointments using the paper-based system for safety reasons.
“It is a significant impact, there’s no doubt about that, and the numbers would be quite large,” Diamond said. Eastern Health delays affect patients across the province, he said, because people come to the St. John’s area for specialist appointments.
Diamond anticipates the health authority delaying non-emergency procedures on Tuesday as well, and potentially Wednesday.
Western Health and Labrador-Grenfell Health appear to have escaped much of the damage, while Central Health is moderately affected, said Haggie, with all of Monday’s booked appointments there cancelled.
The disruption has meant chemotherapy at several hospitals in Western Health’s jurisdiction, including in Corner Brook, Stephenville and Port aux Basques, are not happening Monday. In Labrador-Grenfell Health, all routine laboratory and diagnostic imaging appointments set for Monday will be rescheduled.
Haggie said his department has recommended that COVID-19 testing move away from electronic and phone bookings toward a drop-in basis. The online portal that gives people their test results has been affected, and Haggie said public health officials will used the telephone to notify people of positive results.
Vaccination clinics are unaffected by the outages.
Patients with procedures going ahead despite the issues will be contacted, said Diamond. For the rest, phone lines and web portals have been set up for rescheduling. Eastern Health’s line is 1-833-777-1276, while Central Health’s is 1-844-651-6214.
Diamond said dealing with the cancellations may require staff to put in extra hours on evenings and weekends. The system has overcome recent backlogs stemming from COVID-19 lockdowns and snowstorms, he said, with those experiences helpful in addressing the current one.
No timeline for a fix
Haggie said the Newfoundland and Labrador Centre for Health Information — which handles IT needs for the province, including electronic health records — and telecommunications company Bell Aliant are working on the problem, but there is no clear timeline yet for when things will return to normal.
“They are hoping for days, but we just have to bear in mind that that’s a hope, and continue to work on mitigation from the front-line point of view, to deal with the impacts on patient care,” he said.
There are more questions than answers at this point as to what happened, and the extent of the damage.
Haggie said they “have no information one way or another” about whether patients’ personal information has been compromised.
He deferred questions as to whether branches of the provincial government had been hit to the Department of Digital Government and Service N.L.
The office of the privacy commissioner has been notified, he said, and a slate of organizations and bodies outside the provincial government have been looped in, including Health Canada, the province’s health-care insurer, and law enforcement agencies.
One cybersecurity expert said ransomware attacks have been known to hit health-care services.
“These types of attacks are very virulent,” said Steve Waterhouse, a former information systems security officer with the Department of National Defence, based in Montreal.
“As we speak, they go across the world, and especially they attack health services systems, for the purpose of inducing those health services to pay rapidly to recover access to their systems so they can continue serving the population.”
Ransomware attacks use malicious software to block or encrypt files, with a ransom payment demanded in order to restore access.
Read more from CBC Newfoundland and Labrador