Personal information accessed in May cyber attack, First Nations Health Authority says

The First Nations Health Authority says personal information of employees and patients was accessed in a security breach.

On May 13th, 2024, the Health Authority detected unusual activity on their information technology systems.

They say an initial investigation determined an unauthorized third party gained access to the network, and was in the process of accessing and copying files stored in a certain portion of the network.

The incident was reported to law enforcement and to the Office of the Information and Privacy Commissioner for British Columba.

An investigation into the incident determined most individuals who are included in the following groups have personal information that has been impacted:

1. Current (hired before May 13, 2024) and certain former employees of FNHA (those who received a T4 tax form for the years 2021-2023);
2. First Nations peoples who live or have recently lived in British Columbia and who have a Certificate of Indian Status card;
3. First Nations peoples and their immediate non-First Nations family members who lived on reserve or in First Nations communities in British Columbia on or before March 29, 2016 and who had one or more Tuberculosis screening tests prior to that date; and
4. Individuals who have filed compliments or complaints, or who have had a compliment or complaint filed on their behalf, with FNHA’s Quality Care and Safety Office, or with another provincial health authority’s Patient Care Quality Office where that compliment or complaint was shared with FNHA’s Quality Care and Safety Office between January 1, 2020 – May 13, 2024.

They say the following types of personal information may have been accessed:

• First and last names;
• In some, but not all cases, personal contact information such as home address, home or mobile phone number, and/or email address;
• Demographic information such as date of birth, gender and/or British Columbia registered band or First Nations community name;
• Certificate of Indian Status card number (Status Number);
• Personal Health Number (PHN);
• Health insurance plan eligibility information (e.g. for the Medical Services Plan and for Pacific Blue Cross);
• Pacific Blue Cross health insurance claims information, including in some cases the type, number and associated costs of individual claims;
• Tuberculosis screening test results for those living on reserve or in First Nations communities in British Columbia on or before March 29, 2016; and
• Information about compliments or complaints filed with or managed by the FNHA Quality Care and Safety Office between January 1, 2020 – May 13, 2024.

In response, the Health Authority says they are offering eligible individuals a free two-year subscription to Equifax Complete to help them monitor their credit in the case of stolen identity.

More information on supports can be found here.

They will also be providing mental health and wellness supports, which are available here.

“While no organization is ever completely immune to these types of cyber incidents, the nature of which are continuously evolving, we also want to assure you that we continuously seek opportunities to further strengthen our information security infrastructure,” said First Nations Health Authority CEO Richard Jock.

“We sincerely apologize for the fact that this cyber attack has occurred, and for the impact it may have on you.”