'Extremely suspicious' vaccine website prompts multiple warnings to N.B. residents

A new website that claims to track adverse COVID-19 vaccine reactions is raising concerns and prompting strong warnings about its legitimacy.

The website, NB Adverse Event Reporting System, asks visitors to submit information about medically or personally documented adverse reactions to COVID-19 vaccinations for review by a team of physicians and registered nurses. 

It asks visitors to submit personal medical documentation about which vaccine they received and when, as well as email and phone information so that a followup consultation can be arranged.

It also asks for donations.

But nowhere on the site do administrators identify who is on the team of physicians and nurses, who is authoring the website or which organizations, if any, it is affiliated with. Nor does it provide a registered charity number for the donations. 

In fact, New Brunswick Medical Society president Dr. Mark MacMillan said, virtually everything about the website makes him nervous.

"This website is requiring entry of personal medical history, [but] we don't even know who is authoring this website and where the data is going," he said.

"It is extremely suspicious and very worrisome. I would caution every New Brunswicker, please do not enter data into this web page."

MacMillan also made it clear that despite its implied New Brunswick connection, none of the province's physicians are  involved with the website. 

"The medical society is absolutely not aware of any New Brunswick physicians or allied health care provider [who is] affiliated with this website," he said.

Overall, MacMillan said, the website raised so many red flags that he scrubbed it from his browser immediately after visiting to minimize the risk of virus malware.

"I deleted the URL and did a quick reset on my browser history to make sure that there were no cookies left on my computer. It is gone." 

CBC News reached out via the website's email address on Tuesday to ask who authors the site, who is reviewing the medical documentation, what is being done to keep the documentation secure and how donations would be used, and was told that "at present all questions from the media will have to go through our committee."

"We welcome you to reach out again in the near future when all members have had an opportunity to see your request," the email stated.

It responded to a followup request for this information late Thursday night by stating that "the committee respectfully maintains its position of having no comment at this time." 

Lack of transparency a key concern

New Brunswick cybersecurity expert David Shipley reviewed the website Wednesday night and said it immediately "set off alarm bells."  

"This is a very, very, very sketchy website," said Shipley, who is CEO of the cybersecurity firm Beauceron Security.

Brand new websites, without knowing who's behind them, always set off alarm bells for me because these are classic ways of scamming people or phishing them.- David Shipley, CEO of Beauceron Security

Concern number one, he said, is the website's lack of transparency.

Whoever registered the site on Dec. 2 "has hidden everything, almost all the details, about themselves, so we don't know who created it, or why," Shipley said. 

"They say that they're in New Brunswick but there's no contact information ... Brand new websites without knowing who's behind them always set off alarm bells for me because these are classic ways of scamming people or phishing them."

Shipley also noted the site does not have a privacy policy. Other than saying it is "committed to data integrity, individual privacy and confidentiality," it provides no guarantees for protection of sensitive information.

"I mean they could publish a list that says here's all the people in New Brunswick who said they've had an adverse reaction and this is their email address," said Shipley.

As of Friday morning, the site had added a single line that notes: "Operations are conducted with respect to the Personal Health Information Privacy and Access Act." It also removed its email address from the home page, and changed its name from the previous NB Adverse Reaction Database to NB Adverse Event Reporting System.

But the website's request that visitors provide first and second dose dates and upload their vaccination records prompted Shipley's strongest warning.

"That would be great to make a fake vaccine record," he said. "I would highly recommend you not doing that."

Where to report adverse reactions

MacMillan said there are safe and secure ways to report an adverse vaccine reaction.

"All adverse events should be reported by the physician and by the patient to Public Health," he said.

"That information is then fed up the line to Health Canada and to vaccine monitoring across the country ... I would start with Public Health in New Brunswick." 

Public Health spokesperson Bruce Macfarlane confirmed this reporting structure.

"The timeline for reporting is one working day for serious events and within five working days for other events," Macfarlane said in an email.

"Reporting requires the completion of a dedicated AEFI [adverse events following immunization] report form that is then submitted to Public Health for input into the Public Health Information Solution database."

Asked about the new adverse reaction website, Macfarlane said the department does not comment on "privately managed websites."

However, he echoed MacMillan's and Shipley's cautions about sharing private information.

"Everyone should be careful about where they post their personal health information and other sensitive personal information," he said.

"Be wary of websites that do not clearly indicate who is collecting your information or how it will be used."