Cyber Incident Victim: Centre de Communication Santé des Capitales
Date:
Jan 2024
Location:
Canada
Summary
A ransomware attack disrupted the Centre de Communication Santé des Capitales (CCSC), crippling ambulance dispatch systems and forcing emergency calls from multiple regions to be rerouted to a secondary call center. Paramedics lost digital tools for locating incidents, resorting to personal phones and radio communications, which caused operational delays and increased workload despite officials claiming no public service impact. Call prioritization initially defaulted to the highest emergency level due to system unavailability but was later restored. The organization deployed additional ambulances and transferred dispatchers to mitigate disruptions, though frontline workers reported significant strain. Cybersecurity experts characterized the incident as part of a broader trend targeting critical infrastructure, emphasizing the need for heightened awareness against such specialized criminal networks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 24, 2024, the Centre de Communication Santé des Capitales (CCSC) experienced a ransomware attack that disrupted its ambulance dispatch systems. The outage began Wednesday evening but was confirmed early Thursday morning, forcing the rerouting of all ambulance calls from the Capitale-Nationale, Saguenay-Lac-St-Jean, and Nord-du-Québec regions to the Chaudière-Appalaches Emergency Call Center (CAUCA). This transfer resulted in a higher-than-usual call volume at CAUCA, prompting the temporary relocation of some CCSC emergency medical dispatchers to assist. Officials from the CIUSSS de la Capitale-Nationale and CISSS de Chaudière-Appalaches publicly stated the incident caused no operational impacts, emphasizing added ambulances maintained normal response times and call prioritization.
Paramedics reported severe operational disruptions despite these assurances. The attack paralyzed the computer system used to locate emergency calls, forcing ambulance crews to navigate using personal phones and analog radio communications. Frédéric Maheux, president of the Association des travailleurs du préhospitalier (ATPH), described "total panic on the roads," with crews struggling to reach destinations efficiently. Some ambulances delayed mandatory shift endings due to coordination challenges, exacerbated by CAUCA dispatchers' unfamiliarity with Québec City geography. During the initial outage, all calls were temporarily classified as highest-priority (Level 1) because dispatchers lacked access to triage data, though officials later claimed normal prioritization resumed. Cybersecurity expert Steve Waterhouse contextualized the attack as part of a trend targeting public entities, citing similarities to the 2021 STM ransomware incident. While patient care impacts were not explicitly documented, Maheux confirmed system-wide strain on ambulance services amid preexisting workload pressures.