Erie Shores HealthCare

Summary

A cyberattack disrupted IT services at five southwestern Ontario hospitals, causing patient records and email systems to go offline. The hospitals' IT provider, TransForm, confirmed the incident and began investigating its cause and scope, including whether any patient information was compromised. As a result, scheduled care appointments were postponed, with patients being contacted to reschedule or make alternative arrangements. The hospitals issued a joint statement advising non‑emergency patients to seek care elsewhere to reduce strain while they work to restore operations. Updates on system recovery are being provided as the investigation continues.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday morning, October 23, 2023, TransForm observed abnormal performance activity in the IT systems it provides for five southwestern Ontario hospitals and, exercising caution, decided to shut down all of those systems. TransForm is a local non‑profit that was created by Windsor Regional Hospital, Erie Shores HealthCare, Hôtel‑Dieu Grace Healthcare, Bluewater Health and the Chatham‑Kent Health Alliance to manage IT, supply chain and accounts for its member organizations. Later that same afternoon, TransForm released a statement indicating that its member hospitals, together with Windsor‑Essex Hospice, were affected by a service outage. In the statement TransForm said it was investigating the cause and scope of the incident, including whether any patient information had been compromised. That evening, after further review, TransForm announced that it had determined the hospitals were experiencing a cyberattack and noted that the incident was affecting the hospitals’ ability to deliver care in various ways. Michelle Watters, TransForm’s director of stakeholder relations, told CBC News that the organization would not be providing additional comment on the situation. Watters had earlier said that the abnormal performance activity prompted the precautionary shutdown of all systems. She also reiterated that, at that earlier point, patient care was not believed to be impacted by the outage.

The cyberattack caused online services such as patient records and email to be unavailable since Monday morning, leading hospitals to inform patients with scheduled care appointments that they would be contacted to reschedule or make alternate arrangements. In a joint statement issued Monday night, the five hospitals explained that they might not be able to reach all patients ahead of time and could have to reschedule appointments in person, while urging anyone not requiring emergency care to seek treatment at their primary care provider or local clinic to lessen the burden on the hospitals. Windsor Regional Hospital specifically advised that its email system was offline and provided a telephone number, 519‑254‑5577, for individuals to call for assistance, noting that staff would direct calls as best they could and asking for patience due to possible delays. TransForm said it would continue to provide updates as necessary and that its investigation into the cause and scope of the incident, including any potential effect on patient data, was ongoing. The hospitals also stated they would not be offering further comment on the cyberattack.

Sources

Sources available to members: 1 source.