Cyber Incident Victim: Toronto East Health Network
Date:
Oct 2023
Location:
Canada
Summary
Michael Garron Hospital (Toronto East Health Network) experienced a data security incident involving unauthorized access to patient, staff, clinician, and donor information, though its core patient health database showed no signs of compromise. The hospital activated a Code Grey to coordinate its response, engaging third-party experts and implementing safeguards while maintaining normal clinical operations and patient care services. It offered affected individuals two years of credit monitoring, reported the incident to law enforcement and privacy regulators, and confirmed the event was unrelated to a separate cyberattack impacting other Ontario hospitals sharing a different IT provider.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Michael Garron Hospital (MGH), part of the Toronto East Health Network (TEHN), became aware of a data security incident on October 23, 2023. The hospital immediately engaged third-party experts to investigate the incident’s scope and impact while implementing proactive measures to secure its data and information systems. On October 26, MGH initiated a Code Grey—a protocol for infrastructure loss—to coordinate resources, ensure business continuity, and prepare downtime procedures in case of large-scale IT system failures. Initial assessments confirmed no disruptions to clinical applications, patient care services, or hospital operations, with MGH emphasizing it remained a safe care environment. The hospital confirmed no linkage between this incident and the unrelated cyberattacks targeting five southwestern Ontario hospitals that shared the IT provider TransForm. By October 30, MGH declared a Code Grey All Clear, confirming normal operations across all systems but continuing its investigation into potential data exposure.
The investigation revealed that certain data belonging to patients, staff, credentialed clinicians, and donors had been exposed, though there was no evidence of compromise to the patient health information database. MGH committed to notifying affected individuals in accordance with legal requirements and offered two years of complimentary credit monitoring to staff and clinicians as a precaution against identity fraud. The hospital collaborated with government agencies, law enforcement, and the Ontario Information and Privacy Commissioner, to whom the incident was formally reported. Throughout the response, MGH maintained regular updates via its website and FAQs, underscoring that clinical services operated without interruption. The hospital acknowledged the investigation would require additional time to fully assess the breach’s extent and reiterated its focus on minimizing operational impacts while safeguarding data.