Yukoners affected by breach of personal health information at laboratory testing company

Tue, Dec 17, 2019

NEWS RELEASE

FOR IMMEDIATE RELEASE

DECEMBER 17, 2019         

Yukoners affected by breach of personal health information at laboratory testing company

Yukon Information & Privacy Commissioner is working to inform individuals and health care providers in the territory about the breach

WHITEHORSE – The Information and Privacy Commissioner (IPC) for Yukon has been notified of a cyber-attack and privacy breach of personal health information at LifeLabs, a Canadian company with locations in British Columbia and Ontario. The company performs more than a million lab tests each year to help diagnose, treat, monitor and prevent diseases in Canadians, including Yukoners.

On December 16^th, Diane McLeod-McKay, Yukon’s IPC, was contacted by LifeLabs in regard to an attack on the company’s computer systems that occurred on or before October 28, 2019, when the attack was discovered.

LifeLabs informed the IPC that personal health information of 2,864 Yukoners may have been accessed by the hackers. LifeLabs confirmed that personal health information of 34 Yukoners was disclosed during the breach, because this information was recovered from the hackers. The IPC has not been informed about the identity of Yukoners affected by the breach.

According to LifeLabs, the personal information involved in the breach is: name; address; email, password and login info; date of birth; health card number; and lab test results. LifeLabs advised the IPC that cyber criminals penetrated the company’s systems, extracting data and demanding a ransom.  LifeLabs retained outside cybersecurity consultants to investigate and assist in restoring the security of the data. 

“I am extremely concerned about this breach and the impact it may have on Yukoners affected. This kind of breach can result in harms such as identity theft and fraud, including health care fraud and other harms, if personal health information is revealed publicly, which are all serious matters,” said McLeod-McKay.

“My office is working with LifeLabs to determine the scope of this breach as it pertains to Yukoners and help ensure appropriate actions are taken. LifeLabs plans to directly notify every individual affected by this breach.”

Part of LifeLab’s response to the cyber-attack is to offer its customers cyber security protection services, such as identity theft and fraud protection insurance. LifeLabs has posted an open letter to its customers here.

“LifeLabs has indicated that its cyber security firms advise that the risk to customers in connection with this breach is low and that they have not seen any public disclosure of customer data as part of their investigations,” added McLeod-McKay. “However, my advice to Yukoners is to contact LifeLabs directly if they wish to confirm if their information might have been part of the breach and if so to request the services that LifeLabs is offering. Yukoners may also contact our office with general questions about the cyber-attack and we will do our best to assist. LifeLabs has established a dedicated call centre for this incident, which can be reached at 1-888-918-0467.”

McLeod-McKay’s office is working with LifeLabs to evaluate the need to notify health care providers in the territory who are custodians of person health information. This is because there may be requirements for them to report the breach under Yukon’s Health Information Privacy and Management Act (HIPMA).  She has also reached out to the two largest custodians in Yukon and informed them about the breach.

The IPC has been in contact with the Office of the Information and Privacy Commissioner for British Columbia, which confirmed it is investigating the breach. 

The Ombudsman, Information and Privacy Commissioner and Public Interest Disclosure Commissioner is an independent officer of the Yukon Legislative Assembly. For more information, please go to http://www.ombudsman.yk.ca/.

Contact:

Elaine Schiman  

Communications Manager

Office of the Yukon Ombudsman, Information and Privacy Commissioner & Public Interest Disclosure Commissioner                   

elaine.schiman@ombudsman.yk.ca

867-334-2975

www.ombudsman.yk.ca

Follow us on Twitter