Cyber Incident Victim: TransForm Shared Service Organization
Date:
Oct 2023
Location:
Canada
Summary
A cyberattack targeted a shared service provider for multiple southwestern Ontario hospitals, disrupting online services including patient records and email systems. The incident significantly impacted patient care, necessitating appointment rescheduling and alternate arrangements, with hospitals advising non-emergency patients to seek primary care providers to alleviate strain. Initial claims that patient care remained unaffected were later contradicted by acknowledgments of delays and service interruptions. The provider is investigating the attack's origin, scope, and potential compromise of patient data, while hospitals emphasized operational challenges in directly contacting all affected individuals. Systems remained offline with no restoration timeline provided, and further public commentary was declined by the involved organizations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 23, 2023, TransForm Shared Service Organization, a non-profit IT provider for five southwestern Ontario hospitals, detected abnormal performance activity across its systems. As a precautionary measure, the organization took all systems offline, initiating an investigation that later confirmed a cyberattack affecting Windsor Regional Hospital, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, Bluewater Health, and Chatham-Kent Health Alliance. The outage began Monday morning, disrupting critical hospital operations including patient records, email communications, and other online services. TransForm initially stated patient care remained unaffected but revised this assessment hours later, acknowledging the attack significantly impacted member hospitals' ability to deliver care. Appointment scheduling systems became inoperable, forcing hospitals to manually contact patients scheduled for care in subsequent days to reschedule or arrange alternatives.
The hospitals issued a joint statement Monday night warning they might not reach all patients proactively and might need to reschedule appointments in person. They urged non-emergency patients to seek care through primary providers or clinics to reduce strain on hospital resources. Windsor Regional Hospital provided an alternative phone number for communications due to email outages, anticipating service delays. TransForm launched an investigation into the attack's origin, operational scope, and potential compromise of patient information, but declined to provide additional public commentary beyond initial statements. No restoration timeline was established, with systems remaining offline and the organization committing to further updates as the investigation progressed. The incident marked a significant operational disruption, requiring hospitals to implement manual workflows while prioritizing emergency care amidst ongoing uncertainty about data impacts and system recovery.