FNHA does not take information security or the protection of personal information lightly, but the fulsome investigation of a cybersecurity incident can be a lengthy and detailed process. For security reasons, immediately post-incident the impacted part of the FNHA network was quarantined and remediated until it was determined by our third-party cyber security experts to be safe to access. As soon as safe access was possible, we began investigating exactly what files and what kind of information the attackers had accessed. Most of the impacted files contained no personal or confidential information whatsoever.

That said, through this review process FNHA and its third party experts did identify a significant number of impacted files, some of which were very large and complex, that did contain personal information. These files were then reviewed using both technological and manual processes to identify all of the impacted people and the nature of the impacted personal information. While we were working on answering those questions, we also took the time to arrange for support services, such as the dedicated FNHA Cyber Incident Support Centre, to be delivered to impacted individuals in a culturally safe, trauma-informed manner. As soon as we had answers to both questions, we moved forward to issue this notification.

During our investigation, it quickly became apparent that all current and some former FNHA employees had their payroll-related information copied and taken by the attackers. Because FNHA knew that these employees and former employees were at risk of identify theft as a result, we moved quickly to notify and support this group. FNHA was not yet aware of the other types of personal information that had been impacted, as the investigation was still at a very early stage.

Yes, the notification letter is legitimate and you should take it seriously.

The answer to this question is not the same for everyone, as the impacted files that contained different types of personal information impacted many people in some cases, but only a few people in other cases. Generally speaking, the attackers were able to access the following types of information:

• First and last names;
• In some, but not all cases, personal contact information such as home address, home or mobile phone number; email address;
• Demographic information such as date of birth and gender;
• Certificate of Indian Status Card number;
• Personal Health Number;
• Eligibility information for the FNHA Health Benefits Program (which provides First Nations individuals with access to coverage for the following types of health-related benefits: medical, dental, medical supplies and equipment, medical transportation, mental health, pharmacy and vision care);
• Health insurance claims information, including in some cases the type, number and associated costs of individual claims, of First Nations individuals who are registered for the FNHA Health Benefits Program and who have made claims for dental benefits, medical equipment and supplies benefits, pharmacy benefits (not covered by PharmaCare) and vison care benefits;
• Tuberculosis screening test results for those living on reserve or in First Nations communities in British Columbia and who were tested on or before March 29, 2016; and
• Information about compliments or complaints filed with or managed by the FHNA Quality Care and Safety Office between January 1, 2020 – May 13, 2024.​
  

No. Our investigation confirmed that our electronic medical records system, on which our patient records are stored, was not impacted by this cyber breach. Third party information systems and platforms were not affected by the breach.​

This notification process marks the conclusion of our investigation into this cybersecurity incident. We do not anticipate that there will be any further updates to provide.​

FNHA takes information security and the protection of personal information very seriously. Prior to this incident, we had already implemented, and we are continuing to implement significant security measures to protect our network and the information stored on it. The cyber threat landscape is constantly evolving. FNHA takes a continuous improvement approach to information security to ensure that our security measures keep pace with both known threats and new threats as they emerge.

Yes. On discovery of the cybersecurity incident, we quickly filed a report with law enforcement and we are committed to cooperating with any law enforcement investigations.​

Yes. On discovery of the cybersecurity incident and the fact that personal information had been impacted, we filed a report with the OIPC BC. Throughout our investigation, we have provided updates to the OIPC BC and have sought and acted on their guidance in terms of how to respond appropriately.​

If your status number has been impacted by this incident, we have arranged to provide you with access to Equifax Complete™ Premier credit monitoring and identity theft restoration service for a period of 24 months at no cost to you. To find out if your status number has been impacted, please send an email to cyberincident@fnha.ca including the following information:

• First name;
• Last name; and
• Last 5 digits of your status card number.

If your status card number was impacted, a staff member will email you a unique one time use activation code to register for Equifax. Please note that while FNHA has arranged for the access to the Equifax service, we are not able to register you for the service ourselves.

The deadline to activate your free Equifax credit monitoring account is February 28, 2025. After this date the service will not be available.

On April 1, 2016, service delivery of the Tuberculosis Services for Aboriginal Communities (TBSAC) program was transitioned from the British Columbia Centre for Disease Control (BCCDC) to FNHA. As of that date, the TBSAC program became part of FNHA's Community Health and Wellness services under the title “FNHA Tuberculosis Services". To assist FNHA in taking over this responsibility for service delivery, which includes a focus treatment and follow-up care for First Nations peoples in British Columbia who are exposed to Tuberculosis, we were provided with a file of all First Nations test results up to March 29, 2016.​

The information in the Tuberculosis screening test results file includes the following about each individual:

• First and last name;
• Personal Health Number (PHN), if available;
• TB Number, if one was assigned;
• Name of band to which each individual is registered;
• Date of birth;
• Gender;
• Date(s) of chest x-ray;
• Chest x-ray result(s), expressed as either “Normal" or “Abnormal";
• Skin test date(s);
• Size (in millimetres) of each skin test; and
• Skin test result(s), expressed as “Positive", “Negative", “Doubtful", “Non-Reactive", or “Not Reported." 
  

If you are a First Nations person registered with a band in British Columbia, or if you are an immediate family member living (or have previously lived) on reserve or in First Nations communities in British Columbia​, and you had one or more Tuberculosis screening tests prior to March 29, 2016, it is extremely likely that your information has been impacted.

If you would like to be 100% certain, please call the FNHA Cyber Incident Support line at 1-844-723-6518. Please tell the representative who answers your call that you would like to know if your name is included in the Tuberculosis screening file. The representative will ask you to provide your first and last name, as well as one of the following pieces of information: your status number, your personal health number or your date of birth. The reason we are for asking for this additional information is to ensure that we are giving you the correct information that is about you. There are many cases where there are multiple people on the list with the same or similar first and last names.

Please note that, to respect your privacy, we have not given the call centre representatives access to your actual test results. They will only be able to tell you whether your name is or is not in the list of impacted individuals.

You have a right under British Columbia's >Personal Information Protection Act to request access to your personal information held by FNHA, including your Tuberculosis screening test results. To make an access request, please email privacy@fnha.ca. Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​