Area hospitals impacted by a cyber attack last month have set up a hotline for concerned patients to call and released more details about patient and employee information compromised in the breach.
The hack at TransForm Shared Service Organization impacted computer systems at Bluewater Health, Chatham-Kent Health Alliance, Windsor Regional Hospital, Hotel-Dieu Grace Healthcare, and Erie Shores Healthcare.
The hackers published some information after the hospitals refused to pay ransom.
"We understand the concern this incident has raised within our communities, including patients and our employees and professional staff, and we deeply apologize," said a joint statement released on Monday.
The hospitals said employee payroll, accounts payable, and donor information is safe, and only at Bluewater Health were electronic health records compromised.
"The attackers targeted a Bluewater Health patient database report," said the statement. "They also were able to steal data from an operations file server that housed a segmented employee shared drive used by all our hospitals. The shared drive data included patient and employee information of varied amounts and sensitivity."
The attack impacted each hospital differently, and each is offering employees two years of complimentary credit monitoring.
Bluewater Health in Sarnia appears to have been the most compromised of the five hospitals.
"The stolen data includes information about approximately 5.6 million patient visits made by approximately 267,000 unique patients," the statement said. "Bluewater Health is still in the process of determining the precise individuals included in this database report and the data that was taken."
At Erie Shores Healthcare in Leamington, the cyber criminals stole the social insurance numbers of 352 current and past employees.
They also took a very limited portion of a shared drive used by hospital staff at Windsor Regional Hospital. Some patients were identified only by name or by a brief summary of their condition. The attackers accessed staff schedules but not employee social insurance numbers or banking information.
Officials at Hotel Dieu Grace Healthcare said employee social insurance and banking information appear safe. Investigators are evaluating what patient information was compromised.
Information about 1,446 workers going back to February 2, 2021, was taken at Chatham-Kent Health Alliance. That includes employee names, addresses, social insurance, gender, marital status, date of birth, and basic pay rate.
The hospitals said it will take time to investigate the breach and determine the affected parties, but teams are working around the clock to restore systems, and a timeline should come out in the coming days.
The Ontario Information and Privacy Commissioner is aware of the breach, and those concerned about their cybersecurity can call 519-437-6212 between 8 a.m. and 11 p.m., Monday to Friday.