'Sophisticated' cyberattacks involving B.C. gov't networks found

UPDATE — May 10, 2024: The head of B.C.'s public service has announced that there is a high degree of confidence a state or state-sponsored actor attempted to breach government systems in a cyberattack.

EARLIER STORY:

B.C.'s premier said Wednesday that the government has recently identified "sophisticated cybersecurity incidents" involving government networks.

In a statement, Premier David Eby said the provincial government is working with the Canadian Centre for Cyber Security to find out the extent of the cyberattacks, and implement safety measures.

Eby said that there is no evidence, as of Wednesday, that sensitive information has been compromised in the attack.

"However, the investigation is ongoing and we have more work to do to determine what information may have been accessed," he said.

Eby did not share details regarding which systems in particular were affected by the cyberattack, nor how much data was affected.

His statement adds that the government has informed the Office of the Information and Privacy Commissioner, B.C.'s privacy regulator, of the cyberattack.

"I know the public will have many questions about these incidents, and we will be as transparent as we can without compromising the investigation," he said. "As this complex work proceeds, [the] government will provide British Columbians with updates and information as we are able."

Workers told to change passwords

Eby said last week that the province's chief information officer had directed public service employees to change their passwords to "ensure the security of government email systems."

Government staff were also sent an email late Wednesday from Shannon Salter, deputy minister to the premier and head of the public service, informing them of the incidents.

"As the work continues to investigate these incidents, please change your password from 10 to 14 characters as requested and respond promptly to any other instructions to improve security," said the email, obtained by The Canadian Press.

Eby said, to his knowledge, required password changes last week weren't connected to a cybersecurity incident at London Drugs, the pharmacy and retail chain based in Richmond, B.C.

London Drugs shut its doors for a week throughout Western Canada in response to a cyberattack.

In an interview with CBC News, London Drugs CEO Clint Mahlman was tight-lipped about what occurred during the incident, saying that doing so would put the company at further risk.

The B.C. Libraries Co-operative said last week that it was also targeted by a hacker who threatened to release user data if a ransom was not paid.

Renee Merrifield, innovation and technology critic for the Opposition B.C. United party, told CBC News that the government's statement on Wednesday was "pretty alarming" in that it did not provide much information regarding the cyberattack.

"When you think about government and all of the different private information of its citizens that it holds, this actual cyber breach could be far greater and far worse than what London Drugs experienced," she said.

"This cyber breach could have massive ramifications that are very far-reaching," she added. "And instead of being upfront and transparent immediately, we get this ... press release which doesn't give anyone reassurance at this point."

Eby's Wednesday statement says that protection of data and networks was a top priority for his government.

"Cybersecurity threats are a constant reality of the modern world and continue to grow in seriousness," he said.