Cybersecurity Incident

• 1. Why has it taken so long to notify people that their personal information may have been impacted?

  FNHA does not take information security or the protection of personal information lightly, but the fulsome investigation of a cybersecurity incident can be a lengthy and detailed process. For security reasons, immediately post-incident the impacted part of the FNHA network was quarantined and remediated until it was determined by our third-party cyber security experts to be safe to access. As soon as safe access was possible, we began investigating exactly what files and what kind of information the attackers had accessed. Most of the impacted files contained no personal or confidential information whatsoever.

  That said, through this review process FNHA and its third party experts did identify a significant number of impacted files, some of which were very large and complex, that did contain personal information. These files were then reviewed using both technological and manual processes to identify all of the impacted people and the nature of the impacted personal information. While we were working on answering those questions, we also took the time to arrange for support services, such as the dedicated FNHA Cyber Incident Support Centre, to be delivered to impacted individuals in a culturally safe, trauma-informed manner. As soon as we had answers to both questions, we moved forward to issue this notification.

• 2. Why did certain people, such as FNHA employees, receive a much earlier notification?

  During our investigation, it quickly became apparent that all current and some former FNHA employees had their payroll-related information copied and taken by the attackers. Because FNHA knew that these employees and former employees were at risk of identify theft as a result, we moved quickly to notify and support this group. FNHA was not yet aware of the other types of personal information that had been impacted, as the investigation was still at a very early stage.

• 3. Is the notification letter legitimate?

  Yes, the notification letter is legitimate and you should take it seriously.
  

• 4. What kind of personal information was accessed or copied by the attackers?

  The answer to this question is not the same for everyone, as the impacted files that contained different types of personal information impacted many people in some cases, but only a few people in other cases. Generally speaking, the attackers were able to access the following types of information:

  • First and last names;
  • In some, but not all cases, personal contact information such as home address, home or mobile phone number; email address;
  • Demographic information such as date of birth and gender;
  • Certificate of Indian Status Card number;
  • Personal Health Number;
  • Eligibility information for the FNHA Health Benefits Program (which provides First Nations individuals with access to coverage for the following types of health-related benefits: medical, dental, medical supplies and equipment, medical transportation, mental health, pharmacy and vision care);
  • Health insurance claims information, including in some cases the type, number and associated costs of individual claims, of First Nations individuals who are registered for the FNHA Health Benefits Program and who have made claims for dental benefits, medical equipment and supplies benefits, pharmacy benefits (not covered by PharmaCare) and vison care benefits;
  • Tuberculosis screening test results for those living on reserve or in First Nations communities in British Columbia and who were tested on or before March 29, 2016; and
  • Information about compliments or complaints filed with or managed by the FHNA Quality Care and Safety Office between January 1, 2020 – May 13, 2024.​

• 5. I receive health care services directly from FNHA. Has my actual patient record been impacted?

  No. Our investigation confirmed that our electronic medical records system, on which our patient records are stored, was not impacted by this cyber breach. Third party information systems and platforms were not affected by the breach.​

• 6. Will I receive further updates?

  This notification process marks the conclusion of our investigation into this cybersecurity incident. We do not anticipate that there will be any further updates to provide.​

• 1. What is FNHA doing to prevent future similar incidents?

  FNHA takes information security and the protection of personal information very seriously. Prior to this incident, we had already implemented, and we are continuing to implement significant security measures to protect our network and the information stored on it. The cyber threat landscape is constantly evolving. FNHA takes a continuous improvement approach to information security to ensure that our security measures keep pace with both known threats and new threats as they emerge.

• 2. Did FNHA report this cybersecurity incident to the police?

  Yes. On discovery of the cybersecurity incident, we quickly filed a report with law enforcement and we are committed to cooperating with any law enforcement investigations.​

• 3. Did FNHA report this cybersecurity incident to the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)?

  Yes. On discovery of the cybersecurity incident and the fact that personal information had been impacted, we filed a report with the OIPC BC. Throughout our investigation, we have provided updates to the OIPC BC and have sought and acted on their guidance in terms of how to respond appropriately.​

• 4. What else is FNHA doing to protect me?

  For those individuals who had their status card numbers affected by the cyber incident, FNHA offered free 2-year access to Equifax Complete™ Premier, which included credit monitoring and identity theft services. The deadline to register for this service was
  February 28, 2025. This
  deadline has now passed, and no complementary activation codes are available for issue.

  If, after February 28, 2025, you wish to obtain credit monitoring and identity theft services, please contact Equifax® Canada or TransUnion® Canada directly to inquire about their consumer products, which will be at your own cost.

  ​

  We also understand that learning that your personal information has potentially been impacted by a cyber incident can be very upsetting. FNHA has a variety of mental health and wellness supports available to you at
  www.fnha.ca/cyberincidentsupports​ if you need to access them.

• ​
  

  ​5. Am I at increased risk of identity theft?

  If your status number has been impacted, you may be at risk of identity theft. While FNHA has no evidence that anyone whose status number was impacted actually has experienced identity theft, if do confirm that you are the victim of identity theft, please report this to local police, your financial institutions and Indigenous Services Canada. You can submit a report to Indigenous Services Canada by sending an email to: rigipsoutiennational-iripmnationalsupport@sac-isc.gc.ca.

• 6. What additional steps can I take to protect myself?

  The following are steps that cybersecurity experts recommend you always follow, but are especially important to follow if your personal information has been impacted by a cybersecurity incident:

  • If, after February 28, 2025, you wish to obtain credit monitoring and identity theft services, please contact Equifax® Canada or TransUnion® Canada directly to inquire about their consumer products, which will be at your own cost.
  • Regularly (at least once per month) monitor your financial account statements (e.g. bank accounts, credit cards, investment accounts, etc.) for unusual activity and immediately report  unusual activity to your bank or credit card company;
  • If you have registered for credit monitoring and identity theft services through Equifax or Trans Union you can Order and review a copy of your credit report (which you can do for free once a year) and contact them if your credit report lists any accounts you did not open or inquiries from creditors that you have not authorized to access your credit report;
  • Be alert to any unusual or suspicious email or telephone communications that you might receive and do not provide your passwords or banking PINs to anyone. Do not provide anyone who calls or emails you with any other type of your personal information unless you are absolutely certain who you are communicating with;
  • If you haven’t changed your passwords on your various accounts in a long time, change them now. Use complex passwords that include letters, numbers and symbols. Do not use the same password across multiple accounts (e.g. email, online bank accounts and social media accounts);
  • Do not open attachments or click on links in emails that you aren’t expecting to receive, even if they look like they are coming from someone you know. If possible, call the person and confirm that the email is valid. Do not call a number that is set out in an email if you don’t recognize that number. Look up the number in a separate directory; and
  • If you confirm that you are the subject of identity theft, promptly report this to your local police and obtain the police file number.

• 7. How can I make a complaint about this cybersecurity incident and the impact it is having on me?

  We understand that being impacted by a cyber incident is very upsetting. If, after reading this Q&A document, you have remaining questions or would like to make a complaint to FNHA, you can send an email to
  ​privacy@fnha.ca.

  You also have the option to file a complaint with the OIPC BC. Information on how to file a complaint is available here:
  How do I make a complaint? – Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

  Please note that the OIPC BC has informed us that they will ask you to try to resolve your complaint directly with FNHA first, before their representatives become involved. So please direct your complaint to FNHA first. If we are unable to resolve your complaint to your satisfaction, you can then file a complaint with OIPC BC.

• 8. How can I find out exactly what personal information FNHA has about me?

  You have a right under British Columbia’s
  Personal Information Protection Act to request access to your personal information held by FNHA. To make an access request, please email
  privacy@fnha.ca. Your request must provide sufficient detail to enable FNHA, with a reasonable effort, to identify the individual and the personal information being sought. ​Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​

​

• 1. What are credit monitoring and identify theft protection services?

• ​
  

  2. What protections are in place for minors who have had their status number impacted?

​