Cybersecurity Incident

During the week of May 13, 2024, FNHA responded to an incident in which an unauthorized entity (the attacker) gained access to certain FNHA information technology systems. FNHA detected and immediately responded to this incident while it was occurring, but the attackers were able to access, copy and steal files from one portion of the FNHA network.​

On discovery of the unauthorized access to the FNHA network, FNHA responded immediately to deploy technological countermeasures to secure our files, systems and network from further attack. FNHA was able to interrupt the attackers while they were in the process of copying and stealing files. No aspects of the FNHA network were encrypted by the attackers. Following closely on this immediate response, FNHA retained third party cyber security experts to assist it in containing, investigating and recovering from this incident.

Prior to this incident, FNHA had already implemented significant security measures to protect our network and the information stored on it. These security measures are what enabled us to identify and respond to the incident as it was happening, and to limit what the attackers were able to access and do while they were in our network.

Unfortunately, no organization is completely immune from a cyber attack. The cyber threat landscape is constantly evolving. FNHA takes a continuous improvement approach to information security to ensure that our security measures keep pace with both known threats and with new threats as they emerge.

No, FNHA did not have any contact with the attackers and it did not pay a ransom to anyone. Recent media reports of successful law enforcement take-downs of these types of cyber criminals have clearly demonstrated that, even when an organization does pay a ransom for the return or destruction of data, there are no guarantees that the cyber criminals will make good on their promises.

The attackers published some or all of the files they stole on the dark web, which is an area of the internet that cannot be accessed by the general public using traditional web browsers. Unfortunately, FNHA has no ability to remove this information from the dark web once it has been published.​

FNHA does not take information security or the protection of personal information lightly, but the fulsome investigation of a cybersecurity incident can be a lengthy and detailed process. For security reasons, immediately post-incident the impacted part of the FNHA network was quarantined and remediated until it was determined by our third-party cyber security experts to be safe to access. As soon as safe access was possible, we began investigating exactly what files and what kind of information the attackers had accessed. Most of the impacted files contained no personal or confidential information whatsoever.

That said, through this review process FNHA and its third party experts did identify a significant number of impacted files, some of which were very large and complex, that did contain personal information. These files were then reviewed using both technological and manual processes to identify all of the impacted people and the nature of the impacted personal information. While we were working on answering those questions, we also took the time to arrange for support services, such as the dedicated FNHA Cyber Incident Support Centre, to be delivered to impacted individuals in a culturally safe, trauma-informed manner. As soon as we had answers to both questions, we moved forward to issue this notification.

During our investigation, it quickly became apparent that all current and some former FNHA employees had their payroll-related information copied and taken by the attackers. Because FNHA knew that these employees and former employees were at risk of identify theft as a result, we moved quickly to notify and support this group. FNHA was not yet aware of the other types of personal information that had been impacted, as the investigation was still at a very early stage.

Yes, the notification letter is legitimate and you should take it seriously.

The answer to this question is not the same for everyone, as the impacted files that contained different types of personal information impacted many people in some cases, but only a few people in other cases. Generally speaking, the attackers were able to access the following types of information:

• First and last names;
• In some, but not all cases, personal contact information such as home address, home or mobile phone number; email address;
• Demographic information such as date of birth and gender;
• Certificate of Indian Status Card number;
• Personal Health Number;
• Eligibility information for the FNHA Health Benefits Program (which provides First Nations individuals with access to coverage for the following types of health-related benefits: medical, dental, medical supplies and equipment, medical transportation, mental health, pharmacy and vision care);
• Health insurance claims information, including in some cases the type, number and associated costs of individual claims, of First Nations individuals who are registered for the FNHA Health Benefits Program and who have made claims for dental benefits, medical equipment and supplies benefits, pharmacy benefits (not covered by PharmaCare) and vison care benefits;
• Tuberculosis screening test results for those living on reserve or in First Nations communities in British Columbia and who were tested on or before March 29, 2016; and
• Information about compliments or complaints filed with or managed by the FHNA Quality Care and Safety Office between January 1, 2020 – May 13, 2024.​

No. Our investigation confirmed that our electronic medical records system, on which our patient records are stored, was not impacted by this cyber breach. Third party information systems and platforms were not affected by the breach.​

This notification process marks the conclusion of our investigation into this cybersecurity incident. We do not anticipate that there will be any further updates to provide.​

FNHA takes information security and the protection of personal information very seriously. Prior to this incident, we had already implemented, and we are continuing to implement significant security measures to protect our network and the information stored on it. The cyber threat landscape is constantly evolving. FNHA takes a continuous improvement approach to information security to ensure that our security measures keep pace with both known threats and new threats as they emerge.

Yes. On discovery of the cybersecurity incident, we quickly filed a report with law enforcement and we are committed to cooperating with any law enforcement investigations.​

Yes. On discovery of the cybersecurity incident and the fact that personal information had been impacted, we filed a report with the OIPC BC. Throughout our investigation, we have provided updates to the OIPC BC and have sought and acted on their guidance in terms of how to respond appropriately.​

For those individuals who had their status card numbers affected by the cyber incident, FNHA offered free 2-year access to Equifax Complete™ Premier, which included credit monitoring and identity theft services. The deadline to register for this service was
February 28, 2025. This
deadline has now passed, and no complementary activation codes are available for issue.

If, after February 28, 2025, you wish to obtain credit monitoring and identity theft services, please contact Equifax® Canada or TransUnion® Canada directly to inquire about their consumer products, which will be at your own cost.

​

We also understand that learning that your personal information has potentially been impacted by a cyber incident can be very upsetting. FNHA has a variety of mental health and wellness supports available to you at
fnha.ca/about/about-fnha/data-and-privacy/cybersecurity-incident/​ if you need to access them.

If your status number has been impacted, you may be at risk of identity theft. While FNHA has no evidence that anyone whose status number was impacted actually has experienced identity theft, if do confirm that you are the victim of identity theft, please report this to local police, your financial institutions and Indigenous Services Canada. You can submit a report to Indigenous Services Canada by sending an email to: rigipsoutiennational-iripmnationalsupport@sac-isc.gc.ca.

• The following are steps that cybersecurity experts recommend you always follow, but are especially important to follow if your personal information has been impacted by a cybersecurity incident:

  • If, after February 28, 2025, you wish to obtain credit monitoring and identity theft services, please contact Equifax® Canada or TransUnion® Canada directly to inquire about their consumer products, which will be at your own cost.
  • Regularly (at least once per month) monitor your financial account statements (e.g. bank accounts, credit cards, investment accounts, etc.) for unusual activity and immediately report  unusual activity to your bank or credit card company;
  • If you have registered for credit monitoring and identity theft services through Equifax or Trans Union you can Order and review a copy of your credit report (which you can do for free once a year) and contact them if your credit report lists any accounts you did not open or inquiries from creditors that you have not authorized to access your credit report;
  • Be alert to any unusual or suspicious email or telephone communications that you might receive and do not provide your passwords or banking PINs to anyone. Do not provide anyone who calls or emails you with any other type of your personal information unless you are absolutely certain who you are communicating with;
  • If you haven’t changed your passwords on your various accounts in a long time, change them now. Use complex passwords that include letters, numbers and symbols. Do not use the same password across multiple accounts (e.g. email, online bank accounts and social media accounts);
  • Do not open attachments or click on links in emails that you aren’t expecting to receive, even if they look like they are coming from someone you know. If possible, call the person and confirm that the email is valid. Do not call a number that is set out in an email if you don’t recognize that number. Look up the number in a separate directory; and
  • If you confirm that you are the subject of identity theft, promptly report this to your local police and obtain the police file number.

We understand that being impacted by a cyber incident is very upsetting. If, after reading this Q&A document, you have remaining questions or would like to make a complaint to FNHA, you can send an email to
​privacy@fnha.ca.

You also have the option to file a complaint with the OIPC BC. Information on how to file a complaint is available here:
How do I make a complaint? – Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

Please note that the OIPC BC has informed us that they will ask you to try to resolve your complaint directly with FNHA first, before their representatives become involved. So please direct your complaint to FNHA first. If we are unable to resolve your complaint to your satisfaction, you can then file a complaint with OIPC BC.

You have a right under British Columbia’s
Personal Information Protection Act to request access to your personal information held by FNHA. To make an access request, please email
privacy@fnha.ca. Your request must provide sufficient detail to enable FNHA, with a reasonable effort, to identify the individual and the personal information being sought. ​Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​

Credit monitoring services monitor your credit file on a continuous basis and send you alerts by email when inquiries are made on your file and/or new accounts are opened, as well as monthly reports. This gives you the ability to confirm if a credit inquiry or new account is one that you know about and authorized or to take action if it is not.

Please note that this service is provided to you entirely by email and is only effective if you regularly review and act on the alerts and reports that you receive. The credit reporting agency, Equifax, knows what activity is happening on your credit file, but not whether you authorized that activity. This means that you need an email address to access credit monitoring and to receive and review the alerts and reports.

Identity theft protection services includes both $1 million in identity theft insurance and professional support to help you take the necessary steps to restore your identity.

For those individuals who had their status card numbers affected by the cyber incident, FNHA offered free 2-year access to Equifax Complete™ Premier, which included credit monitoring and identity theft services. The deadline to register for this service was February 28, 2025. This deadline has now passed, and no complementary activation codes are available for issue.

If, after February 28, 2025, you wish to obtain credit monitoring and identity theft services, please contact Equifax® Canada or TransUnion® Canada directly to inquire about their consumer products, which will be at your own cost.

​

On April 1, 2016, service delivery of the Tuberculosis Services for Aboriginal Communities (TBSAC) program was transitioned from the British Columbia Centre for Disease Control (BCCDC) to FNHA. As of that date, the TBSAC program became part of FNHA’s Community Health and Wellness services under the title “FNHA Tuberculosis Services”. To assist FNHA in taking over this responsibility for service delivery, which includes a focus treatment and follow-up care for First Nations peoples in British Columbia who are exposed to Tuberculosis, we were provided with a file of all First Nations test results up to March 29, 2016.​

The information in the Tuberculosis screening test results file includes the following about each individual:

• First and last name;
• Personal Health Number (PHN), if available;
• TB Number, if one was assigned;
• Name of band to which each individual is registered;
• Date of birth;
• Gender;
• Date(s) of chest x-ray;
• Chest x-ray result(s), expressed as either “Normal” or “Abnormal”;
• Skin test date(s);
• Size (in millimetres) of each skin test; and
• Skin test result(s), expressed as “Positive”, “Negative”, “Doubtful”, “Non-Reactive”, or “Not Reported.”

If you are a First Nations person registered with a band in British Columbia, or if you are an immediate family member living (or have previously lived) on reserve or in First Nations communities in British Columbia​, and you had one or more Tuberculosis screening tests prior to March 29, 2016, it is extremely likely that your information has been impacted.

If you would like to be 100% certain, please send an email to privacy@fnha.ca. You will be asked you to provide your first and last name, as well as one of the following pieces of information: your status number, your personal health number or your date of birth. The reason we are for asking for this additional information is to ensure that we are giving you the correct information that is about you. There are many cases where there are multiple people on the list with the same or similar first and last names. ​

You have a right under British Columbia’s
>Personal Information Protection Act to request access to your personal information held by FNHA, including your Tuberculosis screening test results. To make an access request, please email
privacy@fnha.ca. Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​