Cyberattack on Cornwall, Ont. hospital causing delays for patients

Cornwall hospital hit with cyber attack Patient clinics affected by a cyber attack on the Cornwall Community Hospital's computers. CTV's Tyler Fleming reports.

CORNWALL, ONT. — The Cornwall Community Hospital continues to deal with the repercussions of a cyberattack on its computer network, and it warns patients could face delays for scheduled and non-urgent care.

The hospital announced last week that a network issue was identified which was revealed to be a ‘cyber incident’. Nearly a week later, the issue continues to disrupt scheduled and non-urgent care across many departments.

"There is no X-rays. I came in for X-rays and they are sending us over to the building over here," says hospital patient John Branchaud, who points towards a nearby medical imaging clinic. "Everybody has a lot of things to do and when you get here and it’s an extra two hours of your time… it is something to be worried about."

The hospital says it regrets the inconvenience this may cause patients and families and it thanks everyone for their patience and cooperation during this time. The hospital notes on its website that while the incident may impact user access to MyChart medical records, its clinical electronic health record system has not been impacted by the cyber attack.

Details have not been disclosed about what type of cyber attack this is, but technology analyst, Carmi Levy, says it’s likely ransomware.

"It’s all about data, it’s all about profiting off of that data and, unfortunately, they target the most vulnerable targets in society, so hospitals, government agencies, companies and organizations whose very life blood is data," he says. "They infect the target network and then basically say, 'pay a ransom if you want to get your data back,' and, in many cases, many organizations feel they have no other choice but to do that. It is the most opportunistic and nasty of all the types of cyber attacks and there is no surprise that it is the most popular form of cyber attack."

CCH is the latest in a string of cyber attacks targeting hospitals. In 2021, the Kemptville District Hospital reported an attack that forced the hospital to take its network offline and temporarily close its emergency department.

In December, Toronto’s Sick Kids Hospital was also attacked and, in February, the Ross Memorial Hospital in Lindsay, Ont. was infected.

Levy says that ransomware attacks are a global problem and in many cases, the criminals operate beyond borders, outside of police jurisdiction.

"The good news in all of this is that law enforcement agencies around the worked, including the RCMP here in Canada, are increasingly working with their colleagues in other countries and are teaming up to bring these cyber criminals to justice, no matter where they may be operating," says Levy. "Going forward, what this hospital and all other hospitals and government agencies and companies and pretty much all of us need to do is recognize the fundamental vulnerability in a ransomware attack is our people. So, train your people better to recognize the signs and the kinds of messages, the phishing messages that show up in your in box that kick-off these kinds of attacks. These attacks don’t happen randomly; these happen because someone receives a message they thought was from a legitimate source. It was not, they clicked on the link, their computers and then networks were then infected. Unfortunately most organizations, including in health care, are not prioritizing employee training and, as a result, they are more vulnerable than ever before."

The CCH has informed its regional stakeholders, including law enforcement and the Office of the Information and Privacy Commissioner of Ontario (IPC), and continues to provide updates as the investigation and resolution progresses.

"The IPC was notified by the Cornwall Community Hospital about a privacy breach on April 15, 2023. We are currently looking into the matter and cannot provide further details at this time," the privacy commissioner said in a statement to CTV News Ottawa.

The IPC says cyberattacks are becoming an increasingly dangerous threat to the security of personal information.

"Health information is particularly sensitive and privacy breaches can have devastating impacts for individuals. A breach that exposes sensitive medical information could result in embarrassment, discrimination and stigma for those affected. Personal health information can also be used to commit identity theft," The IPC says. "A health privacy breach can have lasting, negative effects on a health care providers’ reputation. Patient privacy is vital if Ontarians are to have confidence in their health care system."

No timeline has been provided as to when the issue will be resolved.