FNHA does not take information security or the protection of personal information lightly, but the fulsome investigation of a cybersecurity incident can be a lengthy and detailed process. For security reasons, immediately post-incident the impacted part of the FNHA network was quarantined and remediated until it was determined by our third-party cyber security experts to be safe to access. As soon as safe access was possible, we began investigating exactly what files and what kind of information the attackers had accessed. Most of the impacted files contained no personal or confidential information whatsoever.

That said, through this review process FNHA and its third party experts did identify a significant number of impacted files, some of which were very large and complex, that did contain personal information. These files were then reviewed using both technological and manual processes to identify all of the impacted people and the nature of the impacted personal information. While we were working on answering those questions, we also took the time to arrange for support services, such as the dedicated FNHA Cyber Incident Support Centre, to be delivered to impacted individuals in a culturally safe, trauma-informed manner. As soon as we had answers to both questions, we moved forward to issue this notification.

During our investigation, it quickly became apparent that all current and some former FNHA employees had their payroll-related information copied and taken by the attackers. Because FNHA knew that these employees and former employees were at risk of identify theft as a result, we moved quickly to notify and support this group. FNHA was not yet aware of the other types of personal information that had been impacted, as the investigation was still at a very early stage.

Yes, the notification letter is legitimate and you should take it seriously.

The answer to this question is not the same for everyone, as the impacted files that contained different types of personal information impacted many people in some cases, but only a few people in other cases. Generally speaking, the attackers were able to access the following types of information:

• First and last names;
• In some, but not all cases, personal contact information such as home address, home or mobile phone number; email address;
• Demographic information such as date of birth and gender;
• Certificate of Indian Status Card number;
• Personal Health Number;
• Eligibility information for the FNHA Health Benefits Program (which provides First Nations individuals with access to coverage for the following types of health-related benefits: medical, dental, medical supplies and equipment, medical transportation, mental health, pharmacy and vision care);
• Health insurance claims information, including in some cases the type, number and associated costs of individual claims, of First Nations individuals who are registered for the FNHA Health Benefits Program and who have made claims for dental benefits, medical equipment and supplies benefits, pharmacy benefits (not covered by PharmaCare) and vison care benefits;
• Tuberculosis screening test results for those living on reserve or in First Nations communities in British Columbia and who were tested on or before March 29, 2016; and
• Information about compliments or complaints filed with or managed by the FHNA Quality Care and Safety Office between January 1, 2020 – May 13, 2024.​
  

No. Our investigation confirmed that our electronic medical records system, on which our patient records are stored, was not impacted by this cyber breach. Third party information systems and platforms were not affected by the breach.​

This notification process marks the conclusion of our investigation into this cybersecurity incident. We do not anticipate that there will be any further updates to provide.​

FNHA takes information security and the protection of personal information very seriously. Prior to this incident, we had already implemented, and we are continuing to implement significant security measures to protect our network and the information stored on it. The cyber threat landscape is constantly evolving. FNHA takes a continuous improvement approach to information security to ensure that our security measures keep pace with both known threats and new threats as they emerge.

Yes. On discovery of the cybersecurity incident, we quickly filed a report with law enforcement and we are committed to cooperating with any law enforcement investigations.​

Yes. On discovery of the cybersecurity incident and the fact that personal information had been impacted, we filed a report with the OIPC BC. Throughout our investigation, we have provided updates to the OIPC BC and have sought and acted on their guidance in terms of how to respond appropriately.​

If your status number has been impacted by this incident, we have arranged to provide you with access to Equifax Complete™ Premier credit monitoring and identity theft restoration service for a period of 24 months at no cost to you. To find out if your status number has been impacted, please click here​. Please note that while FNHA has arranged for the access to this service, we are not able to register you for the service ourselves.

We also understand that learning that your personal information has potentially been impacted by a cybersecurity incident can be very upsetting. FNHA has a variety of mental health and wellness supports available to you at www.fnha.ca/cyberincidentsupports if you need to access them.​​

If your status number has been impacted, you may be at risk of identity theft. While FNHA has no evidence that anyone whose status number was impacted actually has experienced identity theft as a result, we strongly encourage you to take advantage of the Equifax Complete™ Premier service that we are offering.​

The following are steps that cybersecurity experts recommend you always follow, but are especially important to follow if your personal information has been impacted by a cybersecurity incident:

• If you are eligible for credit monitoring and identity theft resolution services, activate your Equifax Complete™ Premier account;
• Regularly (at least once per month) monitor your financial account statements (e.g. bank accounts, credit cards, investment accounts, etc.) for unusual activity and immediately report  unusual activity to your bank or credit card company;
• Order and review a copy of your credit report from Equifax and TransUnion (which you can do for free once a year) and contact them if your credit report lists any accounts you did not open or inquiries from creditors that you have not authorized to access your credit report – note that when you enroll in Equifax Complete™ Premier, you will have daily access to your updated credit file;
• Be alert to any unusual or suspicious email or telephone communications that you might receive and do not provide your passwords or banking PINs to anyone. Do not provide anyone who calls or emails you with any other type of your personal information unless you are absolutely certain who you are communicating with;
• If you haven't changed your passwords on your various accounts in a long time, change them now. Use complex passwords that include letters, numbers and symbols. Do not use the same password across multiple accounts (e.g. email, online bank accounts and social media accounts);
• Do not open attachments or click on links in emails that you aren't expecting to receive, even if they look like they are coming from someone you know. If possible, call the person and confirm that the email is valid. Do not call a number that is set out in an email if you don't recognize that number. Look up the number in a separate directory; and
• If you confirm that you are the subject of identity theft, promptly report this to your local police and obtain the police file number.
  

We understand that being impacted by a cybersecurity incident is very upsetting. If, after reading this Q&A document, you have remaining questions or would like to make a complaint to FNHA, you can contact the dedicated FNHA Cyber Incident Support Centre by phone at 1-844-723-6518. The operating hours of the Support Centre are 7:00 am – 3:00 pm Pacific time, Monday to Friday. You can also contact the Support Centre by email at cyberincident@fnha.ca.

You also have the option to file a complaint with the OIPC BC. Information on how to file a complaint is available here: How do I make a complaint? - Office of the Information and Privacy Commissioner for BC (oipc.bc.ca).

Please note that the OIPC BC has informed us that they will ask you to try to resolve your complaint directly with FNHA first, before their representatives become involved. So please direct your complaint to FNHA first. If we are unable to resolve your complaint to your satisfaction, you can then file a complaint with OIPC BC.

You have a right under British Columbia's Personal Information Protection Act to request access to your personal information held by FNHA. To make an access request, please email privacy@fnha.ca. Your request must provide sufficient detail to enable FNHA, with a reasonable effort, to identify the individual and the personal information being sought. ​Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​

On April 1, 2016, service delivery of the Tuberculosis Services for Aboriginal Communities (TBSAC) program was transitioned from the British Columbia Centre for Disease Control (BCCDC) to FNHA. As of that date, the TBSAC program became part of FNHA's Community Health and Wellness services under the title “FNHA Tuberculosis Services". To assist FNHA in taking over this responsibility for service delivery, which includes a focus treatment and follow-up care for First Nations peoples in British Columbia who are exposed to Tuberculosis, we were provided with a file of all First Nations test results up to March 29, 2016.​

The information in the Tuberculosis screening test results file includes the following about each individual:

• First and last name;
• Personal Health Number (PHN), if available;
• TB Number, if one was assigned;
• Name of band to which each individual is registered;
• Date of birth;
• Gender;
• Date(s) of chest x-ray;
• Chest x-ray result(s), expressed as either “Normal" or “Abnormal";
• Skin test date(s);
• Size (in millimetres) of each skin test; and
• Skin test result(s), expressed as “Positive", “Negative", “Doubtful", “Non-Reactive", or “Not Reported." 
  

If you are a First Nations person registered with a band in British Columbia, or if you are an immediate family member living (or have previously lived) on reserve or in First Nations communities in British Columbia​, and you had one or more Tuberculosis screening tests prior to March 29, 2016, it is extremely likely that your information has been impacted.

If you would like to be 100% certain, please call the FNHA Cyber Incident Support line at 1-844-723-6518. Please tell the representative who answers your call that you would like to know if your name is included in the Tuberculosis screening file. The representative will ask you to provide your first and last name, as well as one of the following pieces of information: your status number, your personal health number or your date of birth. The reason we are for asking for this additional information is to ensure that we are giving you the correct information that is about you. There are many cases where there are multiple people on the list with the same or similar first and last names.

Please note that, to respect your privacy, we have not given the call centre representatives access to your actual test results. They will only be able to tell you whether your name is or is not in the list of impacted individuals.

You have a right under British Columbia's Personal Information Protection Act to request access to your personal information held by FNHA, including your Tuberculosis screening test results. To make an access request, please email privacy@fnha.ca. Please note that when you request access to your personal information, FNHA is legally required to take reasonable steps to authenticate who you are. As a result, we may ask you to provide us with certain information that will verify your identity. Once we have verified your identity, we do not keep a record of the information you provided for that purpose.​​