HSC nurses concerned info hacked in cyberattack

Health Sciences Centre workers are concerned their personal information has been compromised after a ransomware attack at Manitoba’s largest hospital.

Shared Health said Monday a cyberattack had affected certain facility maintenance systems, such as heating, ventilation and air conditioning, as well as door access at HSC.

While Shared Health said patient information hasn’t been compromised, it has not assured workers that their information is secure, the president of the Manitoba Nurses Union said Wednesday. She noted employee badges allow HSC staffers to access different parts of the hospital.

“Those (identity) badges hold a lot of information — personal information,” Darlene Jackson said. “This is all their personal information, their date of birth — their everything is on there.”

Shared Health, the provincial health authority that oversees Manitoba’s health-care system, did not provide any updates on the investigation Wednesday or respond to questions about whether any staff information had been hacked.

“The fact that they’re not confirming that it wasn’t compromised worries me because why wouldn’t you confirm that, if it wasn’t?” Jackson asked.

A Shared Health spokesperson said Tuesday that clinical services continue uninterrupted and patient care is unaffected.

Hospitals are considered critical infrastructure and any cyberattacks fall under the mandate of the federal RCMP. Its northwest region office, responsible for Winnipeg, has not responded to requests for comment about the investigation, where the hack originated and if any other hospitals were targeted.

“Shared Health is dealing with the situation right now,” Premier Wab Kinew said Wednesday.

A 2024 report from Manitoba’s auditor general recommended Shared Health test its cybersecurity response plan.

“Having a plan is one thing, but having gone through the drill, having gone through the exercise is another,” the premier told reporters.

Kinew said cybersecurity was an ever-evolving arms race and stressed the need for drills and staying on top of the latest risks and threats.

“We’re going through a situation right now. We’ll learn from it,” Kinew said.

Innovation and New Technology Minister Mike Moroz said the government is working on regulations for new cybersecurity and artificial intelligence legislation passed in June. A public consultation took place Wednesday night in Winnipeg.

“A lot of the work that comes out of those conversations with Manitobans will go into setting the regulations that set a better operational framework moving forward,” Moroz said.

The Public Sector Artificial Intelligence and Cybersecurity Governance Act says a public sector entity — the government, a government agency, health authority, university, school division or municipality — must comply with regulations governing the use of AI systems and cybersecurity.

Regulations — which haven’t yet been written — could include having to provide information about the use of AI systems, the development of accountability frameworks and the reporting of cybersecurity incidents. The regulations could also set technical standards for the use of AI systems and cybersecurity. The minister may also issue directives about cybersecurity to specific public sector entities.

carol.sanders@freepress.mb.ca