Thousands of B.C. health-care workers’ information exposed in cyberattack

Personal information associated with over 240,000 email addresses may have been taken after a cyberattack targeting the Health Employers Association of BC.

Michael McMillan, the president and CEO of the association, said the breach happened on July 13, with three websites targeted — Health Match BC, the Locums for Rural BC, and the BC Care Aide and Health Community Worker Registry.

He says information obtained could include social insurance numbers, home addresses, passport and licence details, and other personal data about health professionals. He stressed that health records were not affected.

“I sincerely regret that this event happened and I want to assure everyone that we are working with cybersecurity and privacy experts to address the incident, protect and safeguard against future attacks, and notify and support individuals whose personal information may have been involved,” he told reporters Tuesday.

Michael McMillian, President and CEO of the Health Employers Association of BC speaks at a press conference in Vancouver on Tuesday August 1st, 2023. (CityNews Image)

He says it is not known how many people’s information may have been taken.

“Out of an abundance of caution, we are acting as if all the information may have been involved,” he said.

The Health Employers Association is the bargaining agent for 200 publicly funded health care employers, representing 170,000 unionized workers, including physicians, nurses, health science workers and paramedics.

The association president says the Office of the Information and Privacy Commissioner of B.C., the Ministry of Health, law enforcement, and the Canadian Centre for Cybersecurity have all been notified. He adds that when the organization became aware of the breach, the affected server was shut down and the data was transferred to a “clean server.”

“We do know that not all of the information in these databases were taken from this server, but at this time, we are unable to conclusively determine which information was potentially taken,” McMillan explained.

He adds that there is no evidence the information obtained by hackers is being used for anything.

B.C. health minister Adrian Dix says he’s thankful that HEABC is working quickly to address the cyberattack.

“Obviously, no individual or organization wants to be the subject of a cyberattack. Unfortunately, this is the reality of our times,” he told reporters. “No organization is completely immune to attacks or attempted attacks.”

The minister assures that for those who need to access the affected services, they will still be able to do so safely.

With files from The Canadian Press