Personal pregnancy details of Midwives of Windsor patients breached CBC News

pA data breach involving email has exposed the personal and pregnancy information of an unknown number of clients of the Midwives of Windsor CBC News has learned ppThe breach was reported to Ontarios Information and Privacy Commissioner months before it was disclosed to clients of the practice ppNancy Lefebvre is a resident of the Lakeshore area She used midwifery services in 2020 and told CBC News that she was taken aback by the news which she received via emailppI was definitely surprised Lefebvre said You go to a midwife for that higher degree of intimacy and not wanting to be part of like a big corporation  where you dont think thats something that would happenppIt is also concerning because in that span of time a lot can be done with that information and it would have been nice to know soonerppAccording to a letter emailed to some clients the practice says it experienced an email account compromise in April 2023 during which unauthorized individuals accessed one of our email accountsppUpon learning of the incident we acted immediately to secure the email account and retain thirdparty experts to assist us in our investigationppAs a result of the compromise we believe your name mailing address email address telephone number date of birth information regarding your pregnancy treatmentdiagnosis information prescription information patient ID and health insurance information were exposed Your childs name and date of birth may have also been exposed the practice said in a letter to one patient ppThe practice says while it is not aware of any misuse of the information patients are asked to be alert to suspicious communications that could be linked to this incidentppIt was not clear the number of clients affected or whether current as well as former clients were impacted given the breach occurred more than eight months ago ppMidwives of Windsor says the breach has been reported to the Information and Privacy Commissioner of Ontario and law enforcement ppThe office of the Information and Privacy Commissioner of Ontario said to CBC News in a statement the breach was reported on Nov 3 ppOur investigation into this matter is ongoing and we are not able to share any additional details at this time the commissioner said in a statement ppWhen we investigate a privacy breach we look to establish whether the breach has been contained the appropriate people have been notified and whether corrective action has been taken to address the underlying causes of the breach and prevent future breaches the office of the commissioner said Our office can issue orders to compel the health information custodian to undertake these corrective measuresppPatients can file a complaint with the IPC within 12 months of becoming aware of a breach of the Personal Health Information Protection Act PHIPA ppWhen reached by CBC News Midwives of Windsor owner Crystal Hall referred all questions to the practices lawyer and an email address at the practice But the lawyer named could not be found or contacted by CBCppWhile an unknown number of clients may be shocked to find out their information has been compromised situations like this are not exceptional ppAccording to Dave Shipley of Beauceron Security a cybersecurity firm the timeline on breaches of this nature are common ppIn many cases organizations dont know for months that theyve been the victim of a cyberattack Shipley said In fact the average breach is discovered about 200 days after it first happens and this can often happen because cybercrimes have become fairly sophisticatedppThere are an entire group of criminals whose job it is to be the breakandenter specialistsppWhile the number of clients affected remains unclear it is also unclear according to Shipley whether the breached information has been used in an improper manner ppReally the question is Can you conclusively prove that nothing bad has happened this information And they cant Shipley pointed out They lost custody of the information and the fact that nothing bad has yet happened is absolutely meaninglessppThe healthcare system in Canada has never had a bigger target on its backppBelle River resident Lara Kane another client affected by the breach has questions about what could happen to her data but says she understands how common these types of situations have becomeppTheyre the victim in this and you know  I had nothing but great things to say about them and their practice she saidppLefebvre who also praised the service she received from Midwives of Windsor said the data breach has made her reflect on the digital world her child will grow up in ppIt does make me sad for my threeyearold Lefebvre said Shes just little and shes already been exposed to this type of crimeppAudience Relations CBC PO Box 500 Station A Toronto ON Canada M5W 1E6 ppTollfree Canada only 18663064636ppIt is a priority for CBC to create products that are accessible to all in Canada including people with visual hearing motor and cognitive challengesppClosed Captioning and Described Video is available for many CBC shows offered on CBC Gemppp