eHealth Saskatchewan hit by ransomware attack

eHealth Saskatchewan was the victim of a ransomware attack early Sunday.

The company that manages electronic records for the Saskatchewan Health Authority said the attack was immediately detected by antivirus software and staff were alerted.

“We know that no information has found its way out of our organization but we’ve begun shutting down some of our servers and repairing and restoring them,” eHealth CEO Jim Hornell said Monday.

“What we’re discovering is that some of our administrative systems have been impacted and so some files have been encrypted. That basically means they’ve been sort of locked down and requests for ransom have been issued.”

Hornell declined to say how much was demanded by those who perpetrated the attack, but he did say eHealth won’t be paying.

Hornell said staff members were having difficulty opening some of their files Monday and there may be what he called “challenges” with video conferences. He was adamant, however, that every patient’s medical information in the system was safe.

“We know that some of our files have been infected, so what we’re doing really is closing down some of these systems and rebuilding them and making sure that there’s no ransomware in there,” he said.

“Most people are not aware this is even going on out in the clinical world in the health system as such because our clinical systems seem to be safe and well-protected.”

Hornell said eHealth faces “thousands of attacks each day,” but this one was more dangerous because it actually got into the system. While it didn’t get anywhere, it’s another example of cyberattacks the organization faces.

“It’s an ongoing battle,” Hornell said. “People out there seem to target certain industries at certain times and I guess our number came up.”

It’s unclear how long eHealth’s system will be affected while staff rebuild the servers. Hornell said it could be hours, but he admitted it could be days or even weeks.

“We don’t know,” he said. “We just know that we have our hands full right now. It’s not business as usual and we’re making sure that people’s medical information is protected.”

— With files from 650 CKOM’s Brent Bosker