Mother 'livid' after learning children's personal info may have been exposed in cyberattack

A mother of three children in foster care says she wasn't told theirpersonal information could be at risk until a week after acyberattack on the child welfare authority responsible for them.

"I was in shock," said the woman, whoCBC News is not naming in order to protect the identity of her children."I was livid. Why wasn't I notified immediately?"

The mother said her child and family services worker told her that any details she's ever provided to the agency about her or her children might be vulnerable, following a Nov. 21ransomware attackon the Southern First Nations Network of Care (SFNNC).

The SFNNCauthority overseesthe care of more than 5,000 foster children in southern Manitoba through 10 Child and Family Services (CFS) agencies.

"She said they don't [know] exactly what was leaked ... but to be aware that all information may be out there, such as what's happening in court ... plus their birthdays, plus my information, my address, my number,email correspondence," she said.

"I was quite taken aback."

For nearly two weeks, the ransomware attackhas rendered the Southern First Nations Network's entire internal IT system completely unusable. The IT network isused by eight of its 10 childagencies for everything from emailing about foster cases to tracking financial information.

While the attack has locked the system, it'sunclear at this point what, if any, information was compromised.

Told to watch email, bank accounts

The mother said a child and family services worker took her aside during a regular visitation with her son on Nov.29, eight days after the ransomware attack had occurred.

"She said, 'I've got some bad news.' I was thinking it was inregards to visitations."

Instead, the worker revealed the attack.

"She said, 'Your information, along with children's information, is at risk. And how much information, we can't confirm yet.'"

The mother said she regularly uses email to correspond with CFS workers, and the Southern Authority has "pretty much everything" on her and her children since they've been in their care.

"I gave over full identification, birth certificates, my [social insurance number], employment statuseverything on me, I gave to them to co-operate," she said.

TheCFS worker told her to keep an eye on her bank statements, and watch out for "weird"emails or calls.

"This could affect my children's future," she said. "It's affected me mentally already I'm stressed out," she said.

The mother said she wasn't told how orwhen she would get more informationon the situation.

"I don't know what's being done with my information, but it's a violation of my personal information, and my children's personal information. And I don't take that lightly."

'No evidence' data has been taken

CBC News had made multiple requests to the Southern First Nations Network of Care for more details or updates on the investigation, but has not received a response.

A written statement was provided by Diane Kelly, director for child and family services with the Southern Chiefs' Organization, which oversees and appoints the board of the Southern First Nations Network of Care.

"There is no evidence at this time of personal data, of any kind, being taken and or manipulated in any way," Kelly wrote in the statement sent to CBC News.

"Our agencies'[data] has been encrypted and cannot be accessed," she said. Kelly would not say when the data was encrypted.

"We have a leading investigative team working on the situation," she wrote. Kelly would not answer questions about who comprises that investigative team.

"Should things change and/or concerns increase, the network will reach out to any and all relevant stakeholders at that time," she wrote.

Kelly added that Southern Chiefs' Organization "has full confidence in the board of directors of the Southern First Nations Network of Care.All SFNNC board appointments follow the appropriate process."

Last week, CBC News spoke to the head of Sandy Bay Child and Family Services, who said the care network was "dysfunctional" and had published information on its website that made it vulnerable to the cyberattack.

Police investigation could take months

It could be months until police have any updates on the investigation, according to Manitoba RCMP spokesperson Sgt. Paul Manaigre.

The ransomware attack wasreported to RCMP's Headingley detachment on Nov. 24, three days after the breach occurred. Police believe the cyberattackhappened in Headingley, which isalso where the main offices of Southern First Nations Network of Care are located.

In an email to CBC News, Manaigre said the digital forensic investigationto figure out exactly what happened will take considerable time to complete.

The RCMP's major crimes unit has been assigned to the investigation, he said.

Mother of three children in foster care wasn't told their sensitive personal information could be at risk until more than a week after a cyber attack

5 years ago

Duration 2:20

The woman says the Southern First Nations Network of Care never let her know a ransomware attack may have compromised her children's sensitive, confidential information. Instead, she was told eight days after it happened, during a regular visit with one of her kids.