CONFERENCE On Demand: Cyber AI & Automation Summit - Watch Now
Connect with us

Hi, what are you looking for?


Data Breaches

Ransomware Gang Leaks Data Allegedly Stolen From Canadian Hospitals

Five Canadian hospitals have confirmed a ransomware attack as data allegedly stolen from them was posted online.

Five Canadian hospitals have confirmed that patient and employee data that was stolen in a ransomware attack has been leaked online.

The data breach impacts Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital, along with service provider TransForm Shared Service Organization. A shared drive was compromised as part of the incident.

On Monday, Bluewater Health said that a patient database report that included “approximately 5.6 million patient visits made by approximately 267,000 unique patients” was stolen, along with some employee data, from the shared drive.

The organization is now working on identifying the impacted individuals and is also investigating the type of employee information that was compromised.

The shared drive contained information pertaining to 1,446 individuals employed by Chatham-Kent Health Alliance as of February 2, 2021, including their names, addresses, gender, dates of birth, marital statuses, social insurance numbers, and basic pay rates.

The information of some Erie Shores HealthCare patients was also stolen in the attack, along with “approximately 352 current and past employee social insurance numbers”.

For Windsor Regional Hospital and Hôtel-Dieu Grace Healthcare, limited patient and employee information was accessed, but no medical records or social insurance numbers.

No banking information was stolen in the attack, the hospitals said.

Advertisement. Scroll to continue reading.

“All hospitals have some degree of patient and employee information affected. All of our hospitals are diligently investigating the stolen data to determine who is impacted. […] The teams continue to work around the clock to restore systems,” Bluewater Health said, noting that the Ontario Information and Privacy Commissioner has been notified of the incident.

While the organization did not name the threat actor behind the attack, the Daixin ransomware gang has claimed responsibility for the incident and has posted online data allegedly stolen from the five hospitals.

The group claims to have exfiltrated more than 160 GB of data, including thousands of personally identifiable information (PII) and protected health information (PHI) records.

In October last year, the US cybersecurity agency CISA and the FBI warned healthcare organizations of the risk associated with the Daixin ransomware.

Related: CISA, HHS Release Cybersecurity Healthcare Toolkit

Related: Healthcare Organizations Hit by Cyberattacks Last Year Reported Big Impact, Costs

Related: 3.3 Million Impacted by Ransomware Attack at California Healthcare Provider

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


A SaaS ransomware attack against a company’s Sharepoint Online was done without using a compromised endpoint.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


Several major organizations are confirming impact from the latest zero-day exploits hitting Fortra's GoAnywhere software.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.