Table of Contents
“This is just going to happen more and more and more. It’s kind of a cat and a mouse game.”
Article content
More than a year has passed since Saskatchewan Information and Privacy Commissioner Ron Kruzeniski released a report on the most damaging cyber attack in Saskatchewan’s history.
Advertisement
This advertisement has not loaded yet, but your article continues below.
Article content
Hackers paralyzed the province’s health system, potentially accessing millions of files, thousands of which contained the personal health information of Saskatchewan citizens.
To this day, it’s unclear exactly what was taken.
Kruzeniski said the report should serve as a reminder and warning that such attacks — when cyber criminals try to access personal information for the purposes of blackmail and fraud — are becoming more and more common.
“It’s hard for me to envisage a more significant investigation in Saskatchewan,” he said.
The attack began in December, 2020 when an unsuspecting Saskatchewan Health Authority employee opened a Microsoft Word document on a personal device while it was connected to a work computer.
That opened the gate for a ransomware attack on the entire health system. More than two weeks later, hackers revealed their presence by holding the files ransom. At that point, eHealth Saskatchewan later estimated more than 50 million files could have been compromised.
Kruzeniski’s report found eHealth, a Crown treasury board that runs the province’s health infrastructure, missed multiple opportunities to find and halt the hack.
In the resulting fallout, Health Minister Paul Merriman replaced the entire board of the organization with two ministry officials. He accepted almost all of Kruzeniski’s two dozen recommendations, which the organization said it has been chipping away at and reporting on to the commissioner on a quarterly basis.
Advertisement
This advertisement has not loaded yet, but your article continues below.
Article content
Lorri Thacyk, director of communications for eHealth, said scanning of the dark web in search of stolen files found no evidence hackers were seeking to sell the information for profit. She also wrote that the Saskatchewan Health Authority and Ministry of Health had “intensified” cyber security training for staff. They later confirmed that the pass mark for cybersecurity training for employees had been increased from 70 per cent to 90 per cent.
They also confirmed eHealth was working on a recommendation to “undertake a comprehensive review of its security protocols to include in depth investigation when early signs of suspicious activity are detected.”
Ministry of Health spokeswoman Jennifer Graham wrote there are no immediate plans to replace the two senior ministry staff serving as board members.
Instead of a formal governance review, Graham wrote the ministry would make changes at the board level, make improvements in oversight and appoint a new CEO after CEO Jim Hornell left the organization in June.
Kruzeniski said he is satisfied with the pace of change given the constraints the COVID-19 pandemic has put on such work.
“How do you train thousands of people quickly? I have to accept that can’t happen overnight,” he said.
He hopes the organization’s new CEO will address issues of culture at eHealth that were identified by a separate SaskTel report, he said. It found eHealth did not have the resourcing to fulfil its mandate and that instead of collaboration there were “pockets of power which are wielding that power to their own advantage to the detriment of the overall success of the eHealth mandate.”
Advertisement
This advertisement has not loaded yet, but your article continues below.
Article content
“We need the leadership in place that will look at culture. You need a CEO that will walk the talk,” Kruzeniski said.
Governments should treat such cyber attacks not as an “if” but a “when,” he said, noting that his office recently received notice of a cyber attack against the Saskatchewan Liquor and Gaming Authority, for example.
“This is just going to happen more and more and more. It’s kind of a cat and a mouse game.”
[email protected]
twitter.com/zakvescera
-
eHealth CEO stepping down after tumultuous term
-
In damning report, Sask. privacy czar blasts government handling of 2019 cyberattack
-
Minister replaces eHealth board in wake of cyberattack report
The news seems to be flying at us faster all the time. From COVID-19 updates to politics and crime and everything in between, it can be hard to keep up. With that in mind, the Saskatoon StarPhoenix has created an Afternoon Headlines newsletter that can be delivered daily to your inbox to help make sure you are up to date with the most vital news of the day. Click here to subscribe.
More Stories
Well being tech essential for rural health care, but not a ‘silver bullet,’ summit panelists contend –
Health+Tech Podcast Series | McGuireWoods
Payer Insights Method Highlights How Payers and Tech Associates Are Considering About AI, Health and fitness Fairness, and the Client Experience