First Nations Health Authority

Summary

The First Nations Health Authority experienced a cybersecurity incident involving unauthorized access to its corporate network, which was promptly intercepted and blocked through countermeasures. While no system encryption occurred, preliminary findings indicate likely compromise of employee personal information and limited data of others, though clinical systems remained unaffected. The organization engaged third-party cybersecurity experts for forensic investigation and containment, notified affected individuals, and reported the incident to law enforcement and privacy authorities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 13, 2024, the First Nations Health Authority (FNHA) detected unusual activity on its corporate network, prompting an immediate investigation. The organization identified an unauthorized entity that had gained access to the network and deployed countermeasures to block further activity. FNHA confirmed no encryption of servers or systems occurred during the incident. Preliminary findings indicated that some employee personal information and limited personal data of others were likely accessed, though the specific nature of compromised data remained undisclosed. The authority initiated required notifications to impacted individuals while emphasizing no evidence suggested clinical information systems were affected. FNHA engaged third-party cybersecurity experts to assist with containment, remediation, and forensic investigation to determine the incident's scope. The breach was reported to law enforcement and British Columbia's Office of the Information and Privacy Commissioner.

The incident occurred amid a series of unrelated cyberattacks targeting B.C. entities since April 2024, though FNHA and provincial officials confirmed no connection to those events. Forensic analysis remained in early stages as of the initial disclosure, with no public details about the attackers' methods of network infiltration. External cybersecurity experts noted health authorities' historical vulnerability due to bureaucratic challenges and outdated technology practices, highlighting attackers' typical motives to harvest personal data for identity theft or scams. FNHA maintained operational continuity for health program delivery while focusing on breach notifications and support for affected parties. No timeline for completing the investigation or additional technical specifics about countermeasures were disclosed in available statements.

Sources

Sources available to members: 2 sources.