Possible cyberattack hits 'brain' of N.L. health-care system, delaying thousands of appointments

A cyberattack appears to be behind a provincewide disruption of health-care services in Newfoundland and Labrador that has affected thousands of appointments and procedures, including those involving COVID-19 testing.

"We may have been victims of a possible cyberattack by a third party," said Health Minister John Haggie at a news conference Monday morning.

The possible attack first made itself felt Saturday morning, and hit "the brain of the data centre" that powers the province's health-care system, said Haggie.

"We have a system that is damaged," he said.

Sources told CBC News the attack was ransomware, but Haggie said he can't confirm that yet.

"The nature and extent of it are still under investigation," he told reporters. 

One thing is clear: the weekend's events have rocked the health-care system, foremost at Eastern Health, the largest of the province's four health authorities, where almost all procedures except emergency ones have been cancelled.

"It's been a difficult few days," said David Diamond, Eastern Health's CEO.

The range of what's been affected at the health authority is wide, with no patients able to be registered and the entire email system down.

Back to paper

Eastern Health is now using its contingency plan to get by, one that's effectively pushed the health authority into the past.

"[It] means we go back to a paper-based system, which is not very efficient, and slow," said Diamond.

He couldn't put an exact number on how many procedures — ranging from surgeries to chemotherapy to X-rays — have been affected, but estimated it to be in the thousands.

Clinical experts, he said, advised against going ahead with most appointments using the paper-based system for safety reasons.

"It is a significant impact, there's no doubt about that, and the numbers would be quite large," Diamond said. Eastern Health delays affect patients across the province, he said, because people come to the St. John's area for specialist appointments.

Diamond anticipates the health authority delaying non-emergency procedures on Tuesday as well, and potentially Wednesday.

Western Health and Labrador-Grenfell Health appear to have escaped much of the damage, while Central Health is moderately affected, said Haggie, with all of Monday's booked appointments there cancelled.

The disruption has meant chemotherapy at several hospitals in Western Health's jurisdiction, including in Corner Brook, Stephenville and Port aux Basques, are not happening Monday. In Labrador-Grenfell Health, all routine laboratory and diagnostic imaging appointments set for Monday will be rescheduled.

In a news release sent Monday afternoon, the health authority said the problem is affecting some of its systems in the region, but appointments will go ahead Tuesday, with a few exceptions: chemotherapy at Western Memorial hospital is cancelled because the site is run by Eastern Health, and telehealth and virtual appointments scheduled with Eastern Health or Central Health providers are also cancelled. 

Some tests requiring samples to be processed in the Eastern Health region will need to be rescheduled, and anyone needing COVID-19 testing in the Western Health area is asked to call a toll-free number. 

Haggie said his department has recommended that COVID-19 testing move away from electronic and phone bookings toward a drop-in basis. The online portal that gives people their test results has been affected, and Haggie said public health officials will used the telephone to notify people of positive results.

Vaccination clinics are unaffected by the outages.

Patients with procedures going ahead despite the issues will be contacted, said Diamond. For the rest, phone lines and web portals have been set up for rescheduling. Eastern Health's line is 1-833-777-1276, while Central Health's is 1-844-651-6214.

Diamond said dealing with the cancellations may require staff to put in extra hours on evenings and weekends. The system has overcome recent backlogs stemming from COVID-19 lockdowns and snowstorms, he said, with those experiences helpful in addressing the current one.

No timeline for a fix

Haggie said the Newfoundland and Labrador Centre for Health Information — which handles IT needs for the province, including electronic health records — and telecommunications company Bell Aliant are working on the problem, but there is no clear timeline yet for when things will return to normal.

"They are hoping for days, but we just have to bear in mind that that's a hope, and continue to work on mitigation from the front-line point of view, to deal with the impacts on patient care," he said.

There are more questions than answers at this point as to what happened, and the extent of the damage.

Haggie said they "have no information one way or another" about whether patients' personal information has been compromised.

He deferred questions as to whether branches of the provincial government had been hit to the Department of Digital Government and Service N.L.

The office of the privacy commissioner has been notified, he said, and a slate of organizations and bodies outside the provincial government have been looped in, including Health Canada, the province's health-care insurer, and law enforcement agencies.

Speaking with reporters on Monday, PC Opposition leader David Brazil questioned whether the government had done enough to prepare for a possible cybersecurity breach after a similar situation occurred in Nunavut in 2019.

He said the unknown timeline for repairing the system is particularly concerning, especially for those with appointments for urgent needs like cancer treatments.

"This is worrisome to all of us," he said. "We need to know the severity of the situation and we need to get a handle on exactly how we're going to address this."

NDP MHA Jordan Brown called on the government to release more information about the outage.

"We should by now know what is actually going on."

One cybersecurity expert said ransomware attacks have been known to hit health-care services.

"These types of attacks are very virulent,"  said Steve Waterhouse, a former information systems security officer with the Department of National Defence, based in Montreal.

"As we speak, they go across the world, and especially they attack health services systems, for the purpose of inducing those health services to pay rapidly to recover access to their systems so they can continue serving the population."

Ransomware attacks use malicious software to block or encrypt files, with a ransom payment demanded in order to restore access.

Read more from CBC Newfoundland and Labrador