Investigation ongoing, but no firm timeline for restoration, in cyberattack affecting 5 hospitals

There's still no firm answerson whenoperationscould return to normal at five southwestern Ontario hospitals hit by acyberattack on Monday, but the IT company at the centre of the outage saysit expected to have an updateonservice restoration next week.

The attack is affecting TransForm,a non-profit shared services organization that provides IT and other services for Windsor Regional Hospital, Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare and Hotel-Dieu Grace Healthcare.

The agency announced on Mondayit was experiencing a cyberattackthat is affecting email and patient records,leading to delays and cancellations for patients.

Cyberattack hits 5 southwestern Ontario hospitals

11 months ago

Duration 0:37

For a third day in a row, systems such as email and patient records are down at five southwestern Ontario hospitals due to a cyberattack. Technology expert Daniel Tsai shares his insight on the matter. Sonia Tumkur reports.

On Friday, the company issued a statement for the first time sinceconfirming the attack, saying that work is taking place around the clock to restore systems.

"Leading third-party cyber security experts have been engaged and we continue to investigate," the organization said. "We expect to have updates related to the restoration of our systems in the upcoming week."

TransForm said in a previous statement it is assessing whether patient data was affected. It has not commented on the cause or reason forthe cyberattack.

Earlier this week, the office of the Information and Privacy Commissioner of Ontario said ithadn't yet been contacted by TransForm. On Friday, the office said it was in touch with the hospitals and hadopened several files on the matter but couldn't comment further.

TransForm said health-care providers are working to reach patients directly if they need to reschedule appointments.

People are asked toavoid the emergency department, except in true emergencies, and are asked to visit a primary care provider or urgent care clinic when possible.

"We understand the impact this incident is having on members of our community, including patients and our employees and professional staff, and deeply apologize for the inconvenience this has caused," TransForm said in its statement.

"We want to thank everyone for their patience during this time."

Joan Murchison says her daughter has been caught up in delays caused by the cyberattack while awaiting a referral for one of the available spaces in a clinic in Hamilton for a complicated case of celiac disease.

But with her daughter's doctor telling her he was unable to access test results in the Bluewater Health system, Murchison says the referral can't go through.

"It's just very disheartening that there's another delay," Murchison said. "Now, potentially people from the rest of the province will be filling up some spaces and my daughter's going to have to wait longer than already she has had to wait again."

This isn't the first time the Murchison family has seen a cyberattack affect health care: Murchison said they were in the office of a specialist at the Parkwood Institute in London when the doctor's computer became subject to an attack.

"Obviously this is a problem with hospitals that they're being targeted," she said.

"It is completely frustrating and disheartening. You lose faith and trust in this system because ...your information needs to be safe from this kind of thing.

"I can't imagine the stress on the staff, but I wonder how much it's going to set them back later."

TransFormand the hospitals say they willnot be providing further comment because it is a criminal investigation involving police.

The OPP's cyber investigations team is involved in the investigation, and a spokesperson said Friday police did not have any additional comment.

CEO updating unions 'every 2 hours:' ONA

The union representing nurses says it's "a very difficult time at Windsor Regional for its patients and staff."

"Despite the challenges, I give due credit to hospital management for doing the very best they can to keep ONA in the loop, meeting with us frequently and protecting patients," said Ontario Nurses' Association (ONA)first vice-president Angela Preocanin in a statement to CBC News.

ONA said paper charting and records are now in use with the hospital's email and eveninternet systemnot functioning. As well, staff have flagged issues and "potentially violent" patients on paper records.

While medications and treatments may have been late at the beginning of the cyberattack,Preocanin said there is no evidence that is ongoing.

"The hospital's CEO is providing updates approximately every two hours to all the health-care unions, and to staff who wish to sign into an app to receive regular information," ONA said in a statement.

Expert says problem could be extensive

Daniel Tsai is an adjunct professor at the University of Toronto and expert in cyber security. He says the fact the hack has stretched for five days indicates the problem could be "extensive."

"I mean five days is a long time in any industry, especially in health care, to have your systems compromised," Tsaisaid. "That suggests ... the remedy or solution may not be a quick fix of simply restoring some backup drives.

"That means we could be looking at perhaps a longer wait until the systems come back online, but in the meantime, the people most at risk are the patients and those that rely on the hospital care system."

Tsai said that while it's not uncommon for any government agency to keep the details of a situation like this quiet, he says he does feel its an opportunity for the province to show leadership on the issue.

"I think this is actually something for the minister of health and the Doug Ford government totake the lead on it and say 'Hey, we're not gonna let these hospitals do it on their own. We know how serious this is,'" he said.

"This is a serious issue and this is an opportunity not just for the hospitals to step up their cyber security game, but it's also an opportunity for the province to do the same thing."

Mark Sangster is a cyber security author. He says that right now, TransForm is likely working on multiple fronts:with experts to resolve and keep the attack from spreading; with police to find who's responsible; with health-care providers to ensure patient care stays on track; with regulators who could also be investigating; and even with lawyers for a communications strategy.

Sangster recommends that Windsorites concerned their information could be at risk in this cyberattack contact their insurer as well as their financial institution to have them watch for possible fraud or uncommon transactions. They should also be ready to receive any communication from their health care provider or the hospitals themselves.

"We've seen a 20 per centincrease in these types of attacks," Sangster said. "This is a good lesson. As Churchill said post-World War II, never let a good crisis go to waste.

"Other health-care institutions should be looking at what they're doing as far as security ...because frankly these guys don't stop at one. It means they're in the region and they will likely strike other institutions and organizations in in Ontario."