Cyberattacks on health authority, London Drugs not related: BC premier

Article content

A state or state-sponsored cybersecurity attack on the government of B.C.’s network is not related to recent ransomware attacks on the First Nations Health Authority and London Drugs networks, according to the premier’s office.

The province’s network was hacked on April 10, and again on April 29 and May 6. The government blamed a state or state-sponsored actor, and determined it was not a ransomware attack and no sensitive data was compromised.

Article content

Article content

“The cybersecurity incident the B.C. government is addressing is not related to the one faced by London Drugs, nor is it related to the one faced by FNHA,” according to a statement from the premier’s office on Wednesday.

The First Nations Health Authority is the latest high-profile victim of a cybersecurity ransomware attack in the province. It says it discovered the breach on May 13 and “immediately deployed countermeasures to block the unauthorized entity’s access and prevent any further unauthorized activity.”

“While the investigation is still at an early stage, FNHA has uncovered evidence that certain employee information and limited personal information of others has been impacted,” the FNHA said in a statement on its website, adding it does not believe the incident has affected any clinical information systems it uses.

Leaked data was released on INC Ransom on the dark web Wednesday.

It appears to show Canada Life GroupNet plan billing data, procurement contracts as well as business contracts, FNHA budgets, cheques, information on dental services to remote First Nations communities, as well as records and correspondence from the Northern Health Authority.

Article content

Article content

FNHA employees were notified of the security breach on May 15. A letter from the CEO on Tuesday indicated that the preliminary investigation suggests sensitive information that was breached included “certain financial information including corporate credit card information and some or all 2023 T4 statement of remuneration paid forms,” which was “accessed and copied by the unauthorized third party.”

All FNHA corporate credit cards were immediately cancelled and employees were instructed on May 15 to change their passwords. As a precaution, the FNHA said all of those employees who received a T4 form in the 2023 tax year will be covered for two years for free credit monitoring and identity-theft protection services.

The FNHA cybersecurity attack comes on the heels of a security systems attack on Western Canada-based London Drugs retail stores and pharmacies.

The cyberattack on London Drugs’ electronic files, discovered April 28, resulted in the closure of 79 retail and pharmacy stores until May 7. London Drugs said it was orchestrated by a “sophisticated group of global cybercriminals.”

Article content

A threat was posted on ransomware syndicate LockBit saying stolen data would be released unless it was paid $25 million by Thursday. The notice was removed from the website Wednesday.

Shawnigan Lake threat analyst Brett Callow, who works for Emsisoft, an anti-malware and anti-virus software firm, said the significance of the removal is unclear. “What it’s meant in other cases of removal is that the company either paid or agreed to negotiate,” said Callow, who notes there are thousands of such cyberattacks every year.

LockBit claimed Tuesday that London Drugs had offered to pay an $8-million ransom, without providing any evidence.

Tartanbond senior vice-president Jessica Harcombe Fleming, representing London Drugs, declined to offer any further information.

The province says it’s continuing to work with the Canadian Centre for Cyber Security and DART, a cybersecurity training provider, to learn everything it can about the attacks on the province’s network.

The province’s online security network, upgraded at a cost of $50.8 million in 2022, repels about 1.5 billion online security threats a day, according to Shannon Salter, deputy minister to the premier and head of the public service, in an earlier report. The government spends about $28 million each year on cybersecurity, with 76 employees dedicated to just that task.

B.C. Solicitor General Mike Farnworth said previously the attack was deemed sophisticated by cybersecurity experts — the hackers’ attempts to cover their tracks are apparently a hallmark of a state actor or a state-sponsored actor.

Farnworth could not explain why another state would be interested in hacking into the B.C. government network.

ceharnett@timescolonist.com

Article content