Cyber Incident Victim: Altona Clinic
Date:
Feb 2021
Location:
Canada
Summary
Altona Clinic in Manitoba, Canada, experienced a ransomware attack that disrupted operations, with attackers encrypting systems and causing the loss of patient visit records from the day prior to the incident. While clinic officials could not confirm whether patient information was compromised, two independent IT specialists assessed that data exfiltration was unlikely, suggesting the primary intent was to lock rather than access records. The attack necessitated rescheduling appointments for affected patients, as clinical notes from the impacted day were rendered inaccessible. No evidence of data theft was reported, and the clinic’s public communications at the time lacked formal notification or details on mitigation services offered to patients.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 26, 2021, Altona Clinic in Manitoba, Canada, experienced a ransomware attack that disrupted operations. Clinic officials publicly acknowledged the incident through a report by Pembina Valley but did not issue an immediate statement on their website. The attack resulted in the encryption or destruction of patient visit records from February 25, 2021, necessitating rescheduling of appointments for affected individuals. Two independent IT specialists assessed the incident and concluded patient data compromise was unlikely, citing evidence suggesting the attackers' primary objective was data encryption rather than exfiltration. This assessment contrasted with the prevalent double extortion tactics observed in other ransomware incidents, where threat actors typically steal data before encryption to pressure victims into paying ransoms. No evidence emerged confirming whether attackers issued ransom demands or exfiltrated records.
The clinic instructed patients with February 25 appointments to contact staff and rebook visits due to inaccessible clinical documentation. This operational disruption created logistical burdens for patients and care providers, though the clinic did not specify the duration of system outages or recovery timelines. Officials did not disclose technical details about the ransomware variant, initial attack vectors, or affected systems beyond the compromised scheduling data. No supplemental services like credit monitoring were offered, consistent with the assessment that personal information remained secure. Public communication about the incident relied exclusively on third-party media coverage, as the clinic’s website contained no related announcements at the time of initial reporting. The attack’s confined impact appeared limited to appointment rescheduling and temporary record inaccessibility without broader data theft consequences.